Odd file requests

[rogair]

One of my servers just got hit with a bunch of strange file requests. They are clearly directed towards a windows server (which this is not). Here are a few of the requests.

/scripts/..%5c../winnt/system32/cmd.exe
/scripts/root.exe
/MSADC/root.exe
/c/winnt/system32/cmd.exe

And MANY others. There were a few thousand of these type of requests just yesterday. Anyone seen this type of request before and know what it may be. Are they automated hacker tools? I don't run any windows webservers so I've not seen this before, nor do I know standard locations for files.

Thanks

[toma42]

it's a new worm. Below are my countermeasures put in a virtual server which is accessible by ip only.

1. script called scripts with a .htaccess file like this:
   <Files scripts>
   ForceType application/x-httpd-php
   </Files>
   <Files msadc>
   ForceType application/x-httpd-php
   </Files>
   <Files _vti_bin>
   ForceType application/x-httpd-php
   </Files>

_vti_bin and msadc are symlinks to scripts.

this is the body of scripts:
<?
/**
This script will block any ip address which tries to exploit
known IIS bugs. The ip will be blocked for this web site by
ip only (so ets.dhs.org will still work) and it will add the
ip to the hosts.deny file
*/

set_time_limit(0);

// Block the ip from http
error_log("Deny from $REMOTE_ADDR\n", 3, '/var/www/iponly/.htaccess');

// Add to user readable log
error_log(date("M d Y H:i.s") . " - $REMOTE_ADDR blocked because of $REQUEST_URI
\n", 3, "/var/www/iponly/blocklog");

// Block the ip from server
error_log("All: $REMOTE_ADDR\n", 3, '/etc/hosts.deny');

error_log(smbclient //$REMOTE_ADDR/C$ -N -I $REMOTE_ADDR < /var/www/iponly/notify . "\n\n", 3, '/var/www/iponly/smblog');
?>

this is the text of notify:
PUT You_Are_Infected.txt

this is the text of You_Are_Infected.txt:
"
This computer tried to infect my computer. My computer put this text file here
automatically to let you know you are infected.

You can get more information here:
http://www.newsbytes.com/news/01/170225.html
http://www.sarc.com/avcenter/venc/data/[e-mail]
http://www.trusecure.com/html/tspub/hypeorhot/rxalerts/tsa01024_cid177.shtml
"

It's working really well for me. my stats show 90% of the machines hitting me are win NT and 10% are win 2000.

[rogair]

Thanks for the info.

Roger