Is this Nimda probing ?

From: Fred Koschara (wfredk@L5Development.NOSPAM.com)
Date: 12/23/01 

From: wfredk@L5Development.NOSPAM.com (Fred Koschara)
Date: Sun, 23 Dec 2001 20:29:13 GMT

(what an idiot - I didn't include the log listings - thwack!)

Ever since our (new, FreeBSD) server was connected to the Internet, blocks of
entries such as those shown below have been showing up in our error log. After
looking through the articles in this newsgroup, my suspicion that they are
caused by a Nimda-infected system is reinforced, but not confirmed.

If this is indeed Nimda, should I be reporting this activity? (If it's not,
what is it?) Are there any other steps I should be taking?

TIA

-- Fred

  ----------------------- begin log listings ------------------------
[Sun Dec 23 10:40:58 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/scripts/root.exe
[Sun Dec 23 10:40:58 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/MSADC/root.exe
[Sun Dec 23 10:40:59 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/c/winnt/system32/cmd.exe
[Sun Dec 23 10:40:59 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/d/winnt/system32/cmd.exe
[Sun Dec 23 10:40:59 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/scripts/..%5c../winnt/system32/cmd.exe
[Sun Dec 23 10:40:59 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Sun Dec 23 10:40:59 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Sun Dec 23 10:40:59 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/msadc/..%5c../..%5c../..%5c/..<C1>^\../..<C1>^\../..<C1>^\
../winnt/system32/
cmd.exe
[Sun Dec 23 10:40:59 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/scripts/..<C1>^\../winnt/system32/cmd.exe
[Sun Dec 23 10:41:00 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/scripts/..<C0><AF>../winnt/system32/cmd.exe
[Sun Dec 23 10:41:00 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/scripts/..<C1><9C>../winnt/system32/cmd.exe
[Sun Dec 23 10:41:00 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/scripts/..%5c../winnt/system32/cmd.exe
[Sun Dec 23 10:41:00 2001] [error] [client 208.58.173.20] File does not exist:
/web/studiolines/www/scripts/..%2f../winnt/system32/cmd.exe
  ------------------------ end log listings -------------------------

Relevant Pages

  • Re: Make XP Workstation Settings (internet and desktop) for all users.
    ... what "entries" are you referring to? ... I have set up my first XP workstation (to use the NT 4 Domain and to ... > connect to the internet). ... When another user logs on (via the server) XP ...
    (microsoft.public.windowsxp.network_web)
  • unable to send e mails
    ... Server rejects recipient whenever I try to send an 'e' mail. ... I still receive mail and can use the internet without problem. ... Google site for 0x 800ccc79 has many similar entries but as far as I can see ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: Internal/External domain name the same - Not a big deal
    ... I have many networks running "split brain DNS" and have had no problems ... > internet. ... > an Internal DNS setup you will need to create local entries for www ... > resolotion on your mail server. ...
    (microsoft.public.win2000.active_directory)