/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe

[Guest_imported]

Hi,

I run apache 2 on xp to just serve mp3s for my site, but checking my stats i
get strange downloads show up like:
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe
&
MSADC/root.exe
&
/scripts/..%c0%2f../winnt/system32/cmd.exe

why and how?

mark
--

 

[Wullie]

Hi mate,

Don't worry about those...

They are infected IIS machines trying to infect other IIS machines. Apache is not affected by it other than the log entries building up.

It is a virus called Code Red that does this..

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk