get scripts ?

[Anon]

i have just installed an apache server on win2k and had this in the access log

\"GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0\" 404 309

i have a fair idea of what its doing but how do they run that on my server and is it telling them anything or is apache blocking it.

any help or advice would be nice 😛

[khaine]

Apache cant find the file hence the 404 return code. If you look at the end of the log line you can see 404 309 the 404 is the code that your server has returned ( File not found ) all anyone would be able to get from this is that you have a server and it is running. I have logs full of rubbish like this its just a virus trying to get in as long as your server returns 404 there is nothing to worry about.

Mark.

[khaine]

I forgot to add the attacking virus is probably Nimda or codered. If you are patched up correctly or are running on a 'nix system it cant get in so dont worry about it.

Mark.

[Anon]

thanks john,
did some more checking after posting this and fig out it was a damn worm but your first post was very helpfull did not realise about the 404 bit, and thats what worried me i am runing on a win2k but apache seems to be holding up ok.

From what i have read since the post is that
Nimda or codered seem only affective against win2k with the IIS server runing.