Hacker Attempt! Please Help... 1

[redhat22]

This is showing up in my access file... What does it mean?

24.169.16.146 - - [09/Jan/2004:23:00:17 -0700] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284

24.169.16.146 - - [09/Jan/2004:23:00:17 -0700] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282
24.169.16.146 - - [09/Jan/2004:23:00:18 -0700] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292

Also, what does this mean...

24.8.122.80 - - [10/Jan/2004:22:15:07 -0700] "GET /default.ida?XXXXX...XXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 287

Do I have a hacker? How can I block them from accessing my server?

 

[siberian]

They are probably a combination of works and hackers.

Your running apache, nothing to worry about here. These are IIS exploits.

 

[Tracey]

siberian is correct, you are being hit by IIS worms.

If you want to save the bandwidth these are comsuming, or stop the error.log entries, enter this in your httpd.conf:

redirect /scripts

http://www.stoptheviruscold.invalid

redirect /MSADC

http://www.stoptheviruscold.invalid

redirect /c

http://www.stoptheviruscold.invalid

redirect /d

http://www.stoptheviruscold.invalid

redirect /_mem_bin

http://stoptheviruscold.invalid

redirect /msadc

http://stoptheviruscold.invalid

redirect /_vti_bin

http://stoptheviruscold.invalid

redirect /null.ida

http://stoptheviruscold.invalid

RedirectMatch (.*)\cmd.exe

http://stoptheviruscold.invalid$1

RedirectMatch (.*)\root.exe

http://stoptheviruscold.invalid$1

RedirectMatch (.*)default.ida(.*)

http://stoptheviruscold.invalid

RedirectMatch (.*)null.ida(.*)

http://stoptheviruscold.invalid

RedirectMatch (.*)\null.ida(.*)

http://stoptheviruscold.invalid$1

Tracey
Remember... True happiness is not getting what you want...

Its wanting what you have got!