Strange W3svc log entries -- iis security

Frank
7/31/2003 3:24:12 PM

Hello all,

I am getting very strange log entries on one of my web
servers they look like this

Get, /Default.ida,xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Does anyone know what could be causing this. IS it a virus
or a sign of intrusion?

Bernard
8/1/2003 11:30:03 AM

This is an attack using buffer overflow technique.
Refer
http://www.microsoft.com/technet/security/virus/newred.asp

It uses the indexing services to attack.
http://www.microsoft.com/technet/security/bulletin/ms01-033.asp

If looks like to me you server is not up to date,
refer www.microsoft.com/security/
also try
Resources for Securing Internet Information Services
http://support.microsoft.com/?id=282060

Get SP4(w2k), do a windows update, deploy antivirus and get
urlscan..

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...

[quoted text, click to view]

iis security : Strange W3svc log entries