• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

odd apache access log

AH HA..I was right..It is Code RED..


"The "Code Red" worm activity can be identified on a machine by the presence of the following string in a web server log files:

/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531
b%u53ff%u0078%u0000%u00=a "



old :Also looks like you are getting hit with a Code Red variant for something...I think these lines are a telltale


"GET /scripts/..%c0%2f../winnt/system32/cmd.exe?"
and
"GET /scripts/root.exe?"

 


<< AH HA..I was right..It is Code RED..


"The "Code Red" worm activity can be identified on a machine by the presence of the following string in a web server log files:

/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531
b%u53ff%u0078%u0000%u00=a "



old :Also looks like you are getting hit with a Code Red variant for something...I think these lines are a telltale


"GET /scripts/..%c0%2f../winnt/system32/cmd.exe?"
and
"GET /scripts/root.exe?" >>



Thats normal, what about the crud near the bottom of the file (actually like a good 70% of the file)?

EDIT: example:

&oslash;£@&Ocirc;OK<"v&acirc;­}¹&aacute;g^By®N&ograve;­u}¥$t%&eth;&yuml;D6ÐsG?¶{s5{j13.&&ograve;º&THORN; 
&eth;&Aacute;?`&Iacute;HY?~&Iuml;?U¾&uacute;&Auml;&THORN;Q[h¾?]&eacute;/&iacute;?XX&Atilde;&Ntilde; ???)?¿»q??&Oacute;???^h½?±¶?S?@=xY8\?¸Y T&Uuml;?&atilde;&Eacute;²5=£Ob²&aring;&yuml;&Iuml;'Hw&Atilde;?&Iuml;9M&Uuml;&Atilde;&Ouml;&Ugrave;&Iacute;ndi´C a_ .???&igrave;?&Icirc;z&egrave;4 X¢|%­?Q&otilde;?U&uacute;0&Ograve;N&Aacute;zU²&Egrave; a&Ograve; #&igrave;?&atilde;?jº&iuml;ª&egrave;
?&Ocirc;«&Igrave;&iuml;CE¨&Oslash;  J&ccedil;?®Si2`&Agrave; &AElig;?´?[­?S&eth; ­Za5?&Ocirc;v?J6&Ocirc;K&igrave;jX&Acirc;/&icirc;e¨H&Agrave;>±&Ccedil;UF&ouml;º¨÷ ?e&Atilde;&ocirc;?g"M0?°&Aring;9>W?  ¸Ð[&yuml;³&Otilde;mU&&iacute;qa&Ograve;&iacute;7º3X1&Euml;
'&otilde;?Am"?&acirc;y&Ouml;&igrave;&auml;&ntilde;v?R?&Oslash;­&Iuml;¶2uE0×=yb&iuml;&Ocirc;C&Ugrave;?Z??&igrave;G¢jLA,. ¢#l`.?-&Egrave;Ðg&eacute;A&ucirc;?h¬&Iacute;§}&Uuml;&igrave;8S]h2¶&ecirc;s?&otilde;?q&Ccedil;&aacute;÷¹0¬p&uuml; &yuml;&Acirc;?P P?Ð ' &egrave;% d&oslash; &thorn;Q¸1I&Aacute;l&?&yacute;?cN&ouml;vru&egrave;?©?{± v?&agrave; @BB0Hh|¤(i04&thorn; ?ARR&Eacute;nH&agrave;+&aring;??°j>&Ccedil;<_+?¬^¶?A]&Aring;
?7<(&Acirc;?°&Ntilde;? ?&Aring;&agrave;&ntilde;???&igrave;&ucirc;A?&Aring;&Agrave;´ &Atilde;$!?·??S&Euml;h&Ucirc;Va
0?°&Igrave;5<&yacute;t#?X$|K&Aacute;&Otilde;&uacute;?©=*&Ucirc;e&auml;2_&thorn;&acirc;&Ntilde;d&Acirc;&Ecirc;-$¦O?h:H×G??¼&Ecirc;&ccedil;E?#] O?&Ouml;>
¿&Eacute;}×[ &Igrave;×÷>-&Iacute;&Otilde;­??&ugrave;&atilde;&Aring;Ws&Agrave;/?Bb&ocirc;&eacute;&Eacute;&Uuml;G"uT&otilde;X&otilde;?*&Ograve;H_?&Auml;i4Cm,#?   ¸ ? ?&ouml;2&icirc;?pR&Aring;?iS*&Oslash;@#q&Auml;d??&atilde;&Atilde;×&­\OC&agrave;&Auml;ºB° y * &Ccedil;&Ntilde;?P&thorn;@?8h&Aring;±¬&ugrave;?n&Icirc;&Uacute;&w`&yuml;5&Igrave;!?&Uuml;²&uacute;&Ugrave;??
H&?%%$$?XHJw
9?y°?xÐB&szlig;n&Ecirc;&ccedil;;&aelig;x ²?D??&Ntilde;¦ &%&Aring;&acirc;VRVkKg&Aacute;?&szlig;¤&icirc;?B°©&Ugrave;[E"HL)&Egrave;&Ograve;]°³}²?? Gw &Igrave;&Aacute;&AElig;&Aacute;',GH&igrave;,&Otilde;?#&eacute;&Aring;®?&eth;º"&aelig;o?JW&Aacute;$ &Egrave;¿&Ecirc;4??(D&aacute;&AElig;£?a?4??©%§§d#y&Otilde;¨?&Aacute;&Ugrave;? &euml;6?&ntilde;M&Ograve;¡`v
&agrave;P
8Hj ?rN&agrave;"$&egrave;?M! r? &Acirc;?R?.^&Auml;&icirc;¿ &Atilde; ??&Aacute; &egrave;0¤?%&ograve;?&Acirc;&Eacute;h&agrave;&egrave;?J&aring;$&thorn;0TC|???!&Uacute;??\#?L

H
Ð1&Ocirc;&Egrave; &Aacute;&Euml;H~?2!%$¾?¸&Yacute;&Iuml;?Bi,$£?&Ecirc;%??&Uacute;&oslash;+¡?= S&aacute;"­kvfµ&Ocirc;<?d?!&ograve;¶p?1&acirc;&atilde;CF?¨4??-Q01#\&Ouml;&ouml;?kc-#?´&atilde;G9?¸Y×DTQQª#&AElig;?÷&Uacute;¿c&Icirc;¢y&Auml;&oslash;§&aring;-'s¼º+&agrave;G¯&agrave;©p&Auml;?s?&Yacute;??_&Atilde;n?? ?£{???&otilde;?e.&Uacute;J'? X÷®?&Ccedil;?Q?n&Ucirc;&Aacute;?P&auml; &ccedil; H??$e('&?³&icirc; 
¸&Auml;&Eacute;­h[&Iuml;'[F?P&ucirc;a$`>¦3 º! &iuml;«?? &agrave; &yuml;! ²/p?&Egrave;¤$ &otilde;?&Aring;a&Oslash;??&aelig;&Atilde;&Iacute;µ&aacute;&auml; b??? h&Egrave;??&Ntilde; ¥gr|º!°??&Iacute;!:f&Auml;&atilde;D??&ucirc;a?*&eacute;&agrave;?DK» b*°?&Egrave;-¿&Egrave;Q&Ograve;&Egrave;&Iuml;g?}@&Auml;¡&eacute;K!&Euml;LP
&Eacute;`8aIS?1×&ucirc;`0-&Ograve;$t &egrave;?bB?#&iuml;?&Ccedil;C9>&Euml;A?C} `Mdl
F(£&Oacute;&ograve;&Uuml;H¸&ouml;B@&Egrave;a5
&Aring;8bp&Ccedil;¡&Yacute;&Icirc;L5#J&acirc;?KL&agrave;=NY!?±&Oacute;8&uacute;"Y@?JY`&ouml;G+?&eth;`?¤&ograve;&ograve; U&szlig;w?§-?F&aacute;qE31"&AElig;¸ª&ograve;??$²&ograve;S¾&ccedil;&ntilde;vT ,
?>&ecirc;&aacute;U$2Q¤??&szlig;fX&thorn;:&Ouml; &Iacute;ºI©&Ecirc;C&auml; O"k?&acirc;&Egrave;j=?u?\?&yuml;7Ð??&ccedil;&Iuml;h ?>s7???&ccedil;I&Igrave;£&agrave;&Ucirc;¶&&Iacute;o^&eth;¸?u &auml;?®¨?&Ecirc;\±?&Otilde;'&thorn;#?}&Ucirc;¿+?&otilde;a&Auml;RP&Oacute;&Aring;&THORN;c¤b l¬tn&iuml;[&iuml;?¤&Auml;kmgV^D&auml;yp}?¡\&eacute;#&K&aacute;h&igrave;?&Uacute;§¨¿w ¸?bcN:>÷&euml;<?{ °L¼s?&atilde;²&Agrave;&aring;D&Aring;s@&auml;&agrave;n~O&uuml;??_b²&Agrave;k&Ccedil;JK&AElig;.ÐD&Acirc;o&oslash;0x £xl&acirc;?<Ð&eacute;|;?&Ocirc;±?¢n `R&Ouml;&eth;

?AW &ecirc;?²p ­G?y??«¤a&auml;&agrave;?B¡c?? ?¦??&Otilde;@&Euml;?§f&Atilde;&ntilde;·&ucirc;?`¢t&ugrave;|&agrave;¶?% &ocirc;*oA?&agrave;0&Ugrave; ²Ya?¬&icirc;¼&Iuml;&Ccedil;ºYV  e÷?g=&ucirc;u?&Iuml;?Z v&ntilde;|±¿&oacute;3¨+6&ouml;´?9
;&acirc;&Ocirc;?0V&Icirc;O?;6?P??&auml;.?j?5y 
@!)°jPh&iuml;&szlig;$^&ograve;;?DF&atilde;&Ecirc;?·&Icirc;rUm&egrave;&oslash;@'&Icirc;?&ouml;&Ntilde;²yC??¿d, ?«|&ucirc;&Uuml;? ?&Atilde;
&euml;f~&AElig;&ucirc;×)jB&igrave;­^&aring;?&agrave;&yuml;W&oacute;|¢p]?hd&atilde;&aelig;?D6Bn~;&Otilde;m"&ograve;i3?t?&Ecirc;¹f^`&eth;¹x\qÐ?&auml;&Ograve;&Ograve;J?p0Z_l; ¿&Ocirc;§btO¶1º???»%¬VK?&yuml;$U¯´a?¿&Oacute;&Aring;&Ntilde;+????t7?&Uacute;?mÐD0/¨&aelig;y???&agrave;HN,.&&ograve;RL%p&ocirc;?&Eacute;8??&szlig;&atilde;?k&auml;?&eth;y&Ouml;&Auml;.??m&Agrave;HX'q?&Atilde;§?R@ »&Oslash;%g`c&yuml;?R?&Ntilde;³&ouml;&yuml;(&Ouml;&Auml;h???dp??H0`ÐX`&oacute; Ca&Iacute;?&Uuml;&Yacute;DFRA|5<&Otilde;`¨½±¯&eth;¨´ j¢A0`?&Aacute;&oacute;&aring; X&Ntilde;7??&Ucirc; ?&Eacute;¥??fC!¤c µ¢|>&Uuml;´X'&Yacute;&Oslash;&igrave;:&Icirc;º!°??9|&Auml;[>&THORN;&eacute;?X»&ucirc;&Eacute;&Agrave;XO#C&szlig;?G?K&Ucirc;&THORN;&Iacute;½
?J&Igrave😉.?§:?cu&oacute;??¨&icirc;@³&thorn;&agrave;,¸`
?¥%&acirc;`jF&agrave;=&uacute;&thorn;&szlig;®&otilde;¥&Ccedil;H?P(?¾&egrave;&yacute;&Yacute;&eacute;c&Aring; 4`n&Auml; &Icirc;9&ocirc;P?°&Atilde;&auml;?? x&aelig;?&iacute;&agrave; @a?&yuml;&Icirc;&Ccedil;HK&aacute;7?UdR0´&Eacute;C8T&Agrave;j'&egrave;&ugrave😉K&Ntilde;H&Ugrave;U u?^&Ecirc;?{&Atilde;??&Uuml;
Ð?&Aring;&Uuml;£&Ocirc;% ? S??`&??&Uacute;\ª|&Oslash;&ntilde;¿H&Aring;££???K¾>!?&igrave;@T?ZC&?&ouml;NA4¤??G4$eµW?2?&Uuml;&eacute;¿|L?O%¡ A7??&iacute;?o&c &Egrave;&Agrave;&Ntilde;D&Agrave;&Ntilde;©&Egrave; -¹&szlig;&thorn;¬&Ntilde;&Ocirc;E&Igrave; ©ID&Ograve;hfrnC?z?`&iacute;@ B&Egrave;! h&Egrave;d?&ugrave; ¢?&uacute;@&Iuml; %??&thorn;?©0²S? %&icirc;?Xu`?&igrave;¤&Agrave;&Ograve;iB~(7¡£?&igrave;%&iacute;&Ccedil;?Q??,5(²°&THORN;4\&Acirc;??2&auml;1 ~&Oslash;&Oacute;?&Ntilde;`¨ &aacute;=?&oslash;·Y&acirc;bh&Ntilde;iX
8$~N&eacute;?&ograve;&otilde;ÐH`&Ograve;???:&szlig;?¨j4¤¤®+°X&uuml;&¯M?&ugrave;&Auml;&igrave;?%?°S&Agrave;4%¡&Atilde;Q³¥%Y) #J3?f?·&Ocirc;&oslash;  &Agrave;+??5!»??r?&Aacute;l*RY8&uuml;?t{&auml;&Auml;2f& k²3§&igrave;?%?&igrave;&iuml;&Ograve;¡???&Euml;&Aring;!%§?R7Jx??&ucirc;?"&Agrave;
&oslash;`&Agrave; ?&Aacute;?&auml;¬ ?q&igrave;1?{1¡&Igrave;¤&atilde;&yuml; Q&Euml;??&Atilde; ??L
c&Agrave;&Agrave;iD&Ouml;JO? d &agrave;
<@id$?²²Q&Ograve;R??B24? &oslash;b&Agrave;&Ccedil;Ð&eth;G&uuml; 6JI?&auml;?
*  ?b v ,<aC?'?&Ecirc;FDtm£ªU&Uuml;&Agrave;Y0q:?V<t¢}? q\}&ocirc;&Agrave;'v/&THORN;&Egrave;[JMZa tD&Ntilde;< 2³&ugrave;z&icirc;H&Ouml;H#&&Ocirc;b,_I¢+0|)16a *"X£&Atilde;C ?1&¬
??O$#&uuml;Xbd&ocirc;kN&aring;v,??&Acirc;h&acirc;&Atilde;_?&Agrave;¡0°J&yacute;Ш !§%$"g%m?&oslash;k &agrave;y<_&Yacute;"&agrave;$0??? &thorn; ?&Ecirc;'P&Euml;C&icirc;??¿&agrave;K&thorn;?? ?~F"&Igrave;1&Auml;&Auml;&agrave;`X?/?&Ucirc;·&yacute;&Ograve;¡¼&Euml;1a??&oslash;&Otilde;vNh}&egrave;0&Auml;;©¤&Euml;Tr&Eacute;&yacute;&Uuml;??Q&THORN;?~@0&uacute;j"1S>/&ucirc;²?&Ograve;ª"&iuml; &otilde;&Eacute;q_&Ntilde;?lu¹×|Z&Eacute;&ograve;?(?]&&Ucirc;?&ouml;ºm7}&Ntilde;IN]&Yacute;?]X¢&Icirc;p *h0adÐ &Euml;_#&Ucirc;r?¨?`|C!?|IX®y$waX?©&Agrave;&ucirc;&icirc;´uHp&uacute;8&oslash;?DdPmq ?&Oslash;.9?&eacute;8tº"°&AElig;?&Ocirc;,m 3&oslash;"?¬~&aelig;O
³¶AQ&Ucirc; &Iacute;?&ocirc;M&Oslash;I$£&aelig;mWca&Ucirc;?&yuml;&uuml;`»×G&Ntilde;:&Iacute; ??k%o°&AElig;*?¨1B:?l6?&Agrave;&Uuml;`&euml;?DA?&Oacute;?&euml;??®?&uacute; g "?`&Acirc; &Oslash;²jy\hK¤??4@g&ocirc; 9P¨
?w&aring;8&Ocirc;?ri º! &ugrave; ?? &agrave; &yuml;! &Eacute;¥5&szlig;?&agrave;6#&ugrave;GC&iuml;÷8?&Yacute;&auml;§@xH&ugrave;k?/A´@ ,'±&Ntilde;?&Egrave;?Q?A?&Iacute;&szlig;h©B :¢.?&Eacute;&yuml;&iuml;?0Q&aelig;VQ&Ecirc;&Oacute;g?&ucirc;?&Ccedil;Lu¾&Iacute;¶&Atilde;c#&agrave;&ecirc;#&egrave;1(&Oslash;I?&aring; &Oslash;¸w<&Egrave;?e?¢.??*Q£&icirc;&Atilde; 1&ugrave;aP»3a?U&Ntilde;?Bµ]?So³(5&egrave;°?9&Ucirc;a??&yacute;¡÷5a?T.´&thorn;D&Ocirc;1 &Aacute;'?eC'&Eacute;6¢&Euml;@ "?`&Igrave;¶ GNm&uacute;?¸
?  Q&atilde;2?Q«(DYa?bº&Ouml;?Ð3&Otilde;&uacute;??&Atilde;@W´?&acirc;÷&Aacute;A%?&uacute;`n&Ouml;oW??&Otilde;ÐA¤Eq&acirc;,¡s&eacute;&egrave;?&aelig;G?&aelig;¦&ucirc;?¥&Eacute;&Ecirc;??&agrave;¨&Ecirc;Df=&ugrave;&Yacute;??&ntilde;&aacute;&Ocirc;IФ:?&Yacute;?&aacute; r1?×?´Db? A&?=G@4? 9Q?Bl8Ð&igrave;G&ouml;p&eth;&aring;?&Acirc;} ? d°7&Oslash;?|IO&ouml;KR±8?\7&aelig;l&aacute;J g?OD_??N³¨&Uuml;DB&Euml;©&ucirc;:?½?&Ocirc;D &Atilde;?u&Ucirc;A¼&egrave;?&Uacute;n¨&yacute;&Uuml;VU{&Egrave;&ntilde;§&/I&uacute;
 
n0c - no clue. its not my box. my machines work right (yeah, right 😉). I guess we dont rotate the logs, since they go back to the day he installed apache. why would this matter?

agamar - yeah, everyone here has logs full of code red, nimda, and variants. but thats not the odd part

n0c - any idea whats causing it though? the size (i copy/pasted) does not work out to any even multiple of the cluster size...
 


<< n0c - no clue. its not my box. my machines work right (yeah, right 😉). I guess we dont rotate the logs, since they go back to the day he installed apache. why would this matter? >>



It may not. It would have been easier to just download a sample though 😉



<< agamar - yeah, everyone here has logs full of code red, nimda, and variants. but thats not the odd part

n0c - any idea whats causing it though? the size (i copy/pasted) does not work out to any even multiple of the cluster size... >>



No clue. I havent seen anything like it before.
 


<< No clue. I havent seen anything like it before. >>


i think i'll tell him to move to an NT or a *nix instead of win95 for the p150 😀
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top