Re: IIS Logfile

[Anthony Boynes <aboynes () cox net>]

mfernandez () fdta-valles org wrote:

> Thanks to all of you for replying.
>
> This log file is getting weirder. Here are more strange entries:
>
> 2004-10-26 01:04:22 202.38.216.127 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx 80 GET
> /scripts/nsiislog.dll - 401 5 0 - - -
> 2004-10-26 02:54:32 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx 80 GET
> /M83A - 401 5 0 - - -
> 2004-10-26 02:54:32 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx 80
> PROPFIND / - 401 5 15 - TEST -
> 2004-10-26 02:54:33 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx 80 GET
> /scripts/nsiislog.dll - 401 5 0 xxx.xxx.xxx.xxx - -
>
> I am located in the ass of the world (South America) and I don't understand why
> some chinesse and sweden people should be interested on my net? (those IPs are
> from that places)
>
> Like you say, the 401 code means an authorization failure, but, what is they
> trying to do?
>
> Thanks in advance...
>
>
>
>
>
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.
>
>
>  
They probably don't care about what is your network specificially, as 
compromised systems are often just used as a jumping point to reach 
other machines, to conduct denial of service attacks, etc.

Based on the filename listed in the log you may want to read the 
following security bulletin - 
http://www.microsoft.com/technet/security/bulletin/MS03-022.mspx


Anthony Boynes