is this normal in the error_log file ?

[silvernetuk]

Hi,

I have been looking at my main error_log file today and want to know if I should be worried with this:


[Sun Dec 1 15:10:29 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/scripts/root.exe
[Sun Dec 1 15:10:29 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/MSADC/root.exe
[Sun Dec 1 15:10:30 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/c/winnt/system32/cmd.exe
[Sun Dec 1 15:10:31 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/d/winnt/system32/cmd.exe
[Sun Dec 1 15:10:32 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/scripts/..%5c../winnt/system32/cmd.exe
[Sun Dec 1 15:10:32 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Sun Dec 1 15:10:33 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Sun Dec 1 15:10:33 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/cmd.exe
[Sun Dec 1 15:10:34 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/scripts/..Á../winnt/system32/cmd.exe
[Sun Dec 1 15:10:35 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/scripts/..À¯../winnt/system32/cmd.exe
[Sun Dec 1 15:10:36 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/scripts/..Áœ../winnt/system32/cmd.exe
[Sun Dec 1 15:10:39 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/scripts/..%5c../winnt/system32/cmd.exe
[Sun Dec 1 15:10:39 2002] [error] [client 64.83.8.xxx] File does not exist: /usr/local/apache/htdocs/scripts/..%2f../winnt/system32/cmd.exe

There been Load and Loads of these from the same IP all the time

Regards,
Garry

[rich2]

one of the many IIS worms/virii that attack all servers, you are apache, so its not doing anything, but it sure does fill logs!