Re: IIS Logfile

[messanger <messanger () centrum sk>]

It is old vulnerability in IIS 5 running on Windows 2000
http://www.osvdb.org/4535
http://www.microsoft.com/technet/security/bulletin/MS03-022.mspx

Win Xp / Server 2003 are not affcted

regards,
Roman



mfernandez () fdta-valles org wrote:

> Thanks to all of you for replying.
>
> This log file is getting weirder. Here are more strange entries:
>
> 2004-10-26 01:04:22 202.38.216.127 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx 80 GET
> /scripts/nsiislog.dll - 401 5 0 - - -
> 2004-10-26 02:54:32 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx 80 GET
> /M83A - 401 5 0 - - -
> 2004-10-26 02:54:32 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx 80
> PROPFIND / - 401 5 15 - TEST -
> 2004-10-26 02:54:33 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx 80 GET
> /scripts/nsiislog.dll - 401 5 0 xxx.xxx.xxx.xxx - -
>
> I am located in the ass of the world (South America) and I don't understand why
> some chinesse and sweden people should be interested on my net? (those IPs are
> from that places)
>
> Like you say, the 401 code means an authorization failure, but, what is they
> trying to do?
>
> Thanks in advance...
>
>
>
>
>
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.
>
>
>
>
>