[CLUE-Tech] 404's in the log

Roger Frank rfrank at rfrank.net
Mon Nov 5 21:46:06 MST 2001


I put the httpd logfile analyzing program "analog" on my
Apache web server machine for www.8x02.com and was surprised.
Almost 80% of the requests to the site resulted in an
Error 404 Document not found as you can see at
http://www.8x02.com/reports.html which shows only one day
of activity, but 215 Error 404's, far more than all others
combined.

These appear to be requests for windows files as reported
in /var/log/httpd/error_log.*  Is this the signature of a
virus trying to get at my filesystem?  The not-founds are
trying to access cmd.exe through lots of different paths, but
most always with "winnt" in the path.

So what am I seeing here?  A worm trying to get in?

-- 
Roger Frank
Ponderosa High School, Parker, Colorado
rfrank at rfrank.net



More information about the clue-tech mailing list