odd apache access log

[CTho9305]

here it is... note the large blocks of junk. any idea whats causing this? I think the machien runs the newest version for win32.

 

[n0cmonkey]

Looks like a corrupted file or something. How often do you rotate your logs?

 

[Agamar]

AH HA..I was right..It is Code RED..


"The "Code Red" worm activity can be identified on a machine by the presence of the following string in a web server log files:

/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531
b%u53ff%u0078%u0000%u00=a "



old :Also looks like you are getting hit with a Code Red variant for something...I think these lines are a telltale


"GET /scripts/..%c0%2f../winnt/system32/cmd.exe?"
and
"GET /scripts/root.exe?"

 

[n0cmonkey]

<< AH HA..I was right..It is Code RED..


"The "Code Red" worm activity can be identified on a machine by the presence of the following string in a web server log files:

/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531
b%u53ff%u0078%u0000%u00=a "



old :Also looks like you are getting hit with a Code Red variant for something...I think these lines are a telltale


"GET /scripts/..%c0%2f../winnt/system32/cmd.exe?"
and
"GET /scripts/root.exe?" >>



Thats normal, what about the crud near the bottom of the file (actually like a good 70% of the file)?

EDIT: example:

&oslash;£@&Ocirc;OK<"v&acirc;­}¹&aacute;g^By®N&ograve;­u}¥$t%&eth;&yuml;D6ÐsG?¶{s5{j13.&&ograve;º&THORN;

&eth;&Aacute;?`&Iacute;HY?~&Iuml;?U¾&uacute;&Auml;&THORN;Q[h¾?]&eacute;/&iacute;?XX&Atilde;&Ntilde; ???)?¿»q??&Oacute;???^h½?±¶?S?@=xY8\?¸Y T&Uuml;?&atilde;&Eacute;²5=£Ob²&aring;&yuml;&Iuml;'Hw&Atilde;?&Iuml;9M&Uuml;&Atilde;&Ouml;&Ugrave;&Iacute;ndi´C a_.???&igrave;?&Icirc;z&egrave;4 X¢|%­?Q&otilde;?U&uacute;0&Ograve;N&Aacute;zU²&Egrave; a&Ograve; #&igrave;?&atilde;?jº&iuml;ª&egrave;
?&Ocirc;«&Igrave;&iuml;CE¨&Oslash; J&ccedil;?®Si2`&Agrave; &AElig;?´?[­?S&eth; ­Za5?&Ocirc;v?J6&Ocirc;K&igrave;jX&Acirc;/&icirc;e¨H&Agrave;>±&Ccedil;UF&ouml;º¨÷?e&Atilde;&ocirc;?g"M0?°&Aring;9>W?
¸Ð[&yuml;³&Otilde;mU&&iacute;qa&Ograve;&iacute;7º3X1&Euml;
'&otilde;?Am"?&acirc;y&Ouml;&igrave;&auml;&ntilde;v?R?&Oslash;­&Iuml;¶2uE0×=yb&iuml;&Ocirc;C&Ugrave;?Z??&igrave;G¢jLA,. ¢#l`.?-&Egrave;Ðg&eacute;A&ucirc;?h¬&Iacute;§}&Uuml;&igrave;8S]h2¶&ecirc;s?&otilde;?q&Ccedil;&aacute;÷¹0¬p&uuml; &yuml;&Acirc;?PP?Ð ' &egrave;% d&oslash;&thorn;Q¸1I&Aacute;l&?&yacute;?cN&ouml;vru&egrave;?©?{± v?&agrave;@BB
0Hh|¤(i04&thorn; ?ARR&Eacute;nH&agrave;+&aring;??°j>&Ccedil;<_+?¬^¶?A]&Aring;
?7<(&Acirc;?°&Ntilde;??&Aring;&agrave;&ntilde;???&igrave;&ucirc;A?&Aring;&Agrave;´ &Atilde;$!?·??S&Euml;h&Ucirc;Va
0?°&Igrave;5<&yacute;t#?X$|K&Aacute;&Otilde;&uacute;?©=*&Ucirc;e&auml;2_&thorn;&acirc;&Ntilde;d&Acirc;&Ecirc;-$¦O?h:H×G??¼&Ecirc;&ccedil;E?#]O?&Ouml;>
¿&Eacute;}×[&Igrave;×÷>-&Iacute;&Otilde;­??&ugrave;&atilde;&Aring;Ws&Agrave;/?Bb&ocirc;&eacute;&Eacute;&Uuml;G"uT&otilde;X&otilde;?*&Ograve;H_?&Auml;i4Cm,#? 
¸ ? ?&ouml;2&icirc;?pR&Aring;?iS*&Oslash;@#q&Auml;d??&atilde;&Atilde;×&­\OC&agrave;&Auml;ºB° y * &Ccedil;&Ntilde;?P&thorn;@?8h&Aring;±¬&ugrave;?n&Icirc;&Uacute;&w`&yuml;5&Igrave;!?&Uuml;²&uacute;&Ugrave;??
H&?%%$$?XHJw
9?y°?xÐB&szlig;n&Ecirc;&ccedil;;&aelig;x²?D??&Ntilde;¦&%&Aring;&acirc;VRVkKg&Aacute;?&szlig;¤&icirc;?B°©&Ugrave;[E"HL)&Egrave;&Ograve;]°³}²??Gw &Igrave;&Aacute;&AElig;&Aacute;',GH&igrave;,&Otilde;?#&eacute;&Aring;®?&eth;º"&aelig;o?JW&Aacute;$&Egrave;¿&Ecirc;4??(D&aacute;&AElig;£?a?4??©%§§d

#y&Otilde;¨?&Aacute;&Ugrave;? &euml;6?&ntilde;M&Ograve;¡`v
&agrave;P
8Hj ?rN&agrave;"$&egrave;?M!r? &Acirc;?R?.^&Auml;&icirc;¿ &Atilde; ??&Aacute;&egrave;0¤?%&ograve;?&Acirc;&Eacute;h&agrave;&egrave;?J&aring;$&thorn;0TC|???!&Uacute;??\#?L

H
Ð1&Ocirc;&Egrave; &Aacute;&Euml;H~?2!%$¾?¸&Yacute;&Iuml;?
Bi,$£?&Ecirc;%??&Uacute;&oslash;+¡?=S&aacute;"­kvfµ&Ocirc;<?d?!&ograve;¶p?1&acirc;&atilde;CF?¨4??-Q01#\&Ouml;&ouml;?kc-#?´&atilde;G9?¸Y×DTQQª#&AElig;?÷&Uacute;¿c&Icirc;¢y&Auml;&oslash;§&aring;-'s¼º+&agrave;G¯&agrave;©p&Auml;?s?&Yacute;??_&Atilde;n?? ?£{???&otilde;?e.&Uacute;J'?X÷®?&Ccedil;?Q?n&Ucirc;&Aacute;?P&auml; &ccedil;H??$e('&?³&icirc;

¸&Auml;&Eacute;­h[&Iuml;'[F?P&ucirc;a$`>¦3
º! &iuml;«??
&agrave; &yuml;! ²/p?&Egrave;¤$&otilde;?&Aring;a&Oslash;??&aelig;&Atilde;&Iacute;µ&aacute;&auml; b??? h&Egrave;??&Ntilde; ¥gr|º!°??&Iacute;!:f&Auml;&atilde;D??&ucirc;a?*&eacute;&agrave;?DK» b*°?&Egrave;-¿&Egrave;Q&Ograve;&Egrave;&Iuml;g?}@&Auml;¡&eacute;K!&Euml;LP
&Eacute;`8aIS?1×&ucirc;`0-&Ograve;$t &egrave;?bB?#&iuml;?&Ccedil;C9>&Euml;A?C} `Mdl
F(£&Oacute;&ograve;&Uuml;H¸
&ouml;B@&Egrave;a5
&Aring;8bp&Ccedil;¡&Yacute;&Icirc;L5#J&acirc;?KL&agrave;=NY!?±&Oacute;8&uacute;"Y@?JY`&ouml;G+?&eth;`?¤&ograve;&ograve; U&szlig;w?§-?F&aacute;qE31"&AElig;¸ª&ograve;??$²&ograve;S¾&ccedil;&ntilde;vT,
?>&ecirc;&aacute;U$2Q¤??&szlig;fX&thorn;:&Ouml; &Iacute;ºI©&Ecirc;C&auml;O"k?&acirc;&Egrave;j=?u?\?&yuml;7Ð??&ccedil;&Iuml;h ?>s7???&ccedil;I&Igrave;£&agrave;&Ucirc;¶&&Iacute;o^&eth;¸?u&auml;?®¨?&Ecirc;\±?&Otilde;'&thorn;#?}&Ucirc;¿+?&otilde;a&Auml;RP&Oacute;&Aring;&THORN;c¤b l¬tn&iuml;[&iuml;?¤&Auml;km
gV^D
&auml;yp}?¡\&eacute;#&K&aacute;h
&igrave;?&Uacute;§¨¿w
¸?bcN:>÷&euml;<?{ °L¼s?&atilde;²&Agrave;&aring;D&Aring;s@&auml;&agrave;n~O
&uuml;??_b²&Agrave;k&Ccedil;JK&AElig;.ÐD&Acirc;o&oslash;0x£x
l&acirc;?<Ð&eacute;|;?&Ocirc;±?¢n `R&Ouml;&eth;

?AW &ecirc;?²p­G?y??«¤a&auml;&agrave;?B¡c?? ?¦??&Otilde;@&Euml;?§f&Atilde;&ntilde;·&ucirc;?`¢t&ugrave;|&agrave;¶?% &ocirc;*oA?&agrave;0
&Ugrave;²Ya?¬&icirc;¼&Iuml;&Ccedil;ºYV  e÷?g=&ucirc;u?&Iuml;?Z v&ntilde;|±¿&oacute;3¨+6&ouml;´?9

;&acirc;&Ocirc;?0V&Icirc;O?;6?P??&auml;.?j?5y 
@!)
°jPh&iuml;&szlig;$^&ograve;;?DF&atilde;&Ecirc;?·&Icirc;rUm&egrave;&oslash;@'&Icirc;?&ouml;&Ntilde;
²yC??¿d, ?«|&ucirc;&Uuml;? ?&Atilde;
&euml;f~&AElig;&ucirc;×)jB&igrave;­^&aring;?&agrave;&yuml;W&oacute;|¢p]?hd&atilde;&aelig;?D6Bn~;&Otilde;m"&ograve;i3?t?&Ecirc;¹f^`&eth;¹x\qÐ?&auml;&Ograve;&Ograve;J?p0Z_l; ¿&Ocirc;§btO¶1º???»%
¬VK?&yuml;$U¯´a?¿&Oacute;&Aring;&Ntilde;+????
t7?&Uacute;?mÐD0/¨&aelig;y???&agrave;HN,.&&ograve;RL%p&ocirc;?&Eacute;8??&szlig;&atilde;?k&auml;?&eth;y&Ouml;&Auml;.??m&Agrave;HX'q?&Atilde;§?R@
»&Oslash;%g`c&yuml;?R?&Ntilde;³&ouml;&yuml;(&Ouml;&Auml;h???dp??H0`ÐX`&oacute;Ca&Iacute;?&Uuml;&Yacute;DFRA|5<&Otilde;`¨½±¯&eth;¨´ j¢A0`?&Aacute;&oacute;&aring; X&Ntilde;7??&Ucirc; ?&Eacute;¥??fC!¤c µ¢|>&Uuml;´X'&Yacute;&Oslash;&igrave;:&Icirc;º!°??9|&Auml;[>&THORN;&eacute;?X»&ucirc;&Eacute;&Agrave;XO#C&szlig;?G?K&Ucirc;&THORN;&Iacute;½
?J&Igrave.?§:?cu&oacute;??¨&icirc;@³&thorn;&agrave;,¸`
?¥%&acirc;`jF&agrave;=&uacute;&thorn;&szlig;®&otilde;¥&Ccedil;H?P(?¾&egrave;&yacute;&Yacute;&eacute;c&Aring;4`n&Auml; &Icirc;9&ocirc;P?°&Atilde;&auml;?? x&aelig;?&iacute;&agrave;@a?&yuml;&Icirc;&Ccedil;HK&aacute;7?UdR0´&Eacute;C8T&Agrave;j'&egrave;&ugraveK&Ntilde;H&Ugrave;U u?^&Ecirc;?{&Atilde;??&Uuml;
Ð?&Aring;&Uuml;£&Ocirc;% ?S??`&??&Uacute;\ª|&Oslash;&ntilde;¿H&Aring;££???K¾>!?&igrave;@T?ZC&?&ouml;NA4¤??G4$eµW?2?&Uuml;&eacute;
¿|L?O%¡ A7??&iacute;
?o&c &Egrave;&Agrave;&Ntilde;D&Agrave;&Ntilde;©&Egrave;-¹&szlig;&thorn;¬&Ntilde;&Ocirc;E&Igrave;©ID&Ograve;hfrnC?z?`&iacute;
@ B&Egrave;! h&Egrave;d?&ugrave;¢?&uacute;@&Iuml; %??&thorn;?©0²S? %&icirc;?Xu`?&igrave;
¤&Agrave;&Ograve;iB~(7¡£?&igrave;%&iacute;&Ccedil;?Q??,5(²°&THORN;4\&Acirc;??2&auml;1 ~&Oslash;&Oacute;?&Ntilde;`¨&aacute;=?&oslash;·Y&acirc;bh
&Ntilde;iX
8$~N&eacute;?&ograve;&otilde;ÐH`&Ograve;???:&szlig;?¨j4¤¤®+°X&uuml;&¯
M?&ugrave;&Auml;&igrave;?%?°S&Agrave;4%¡&Atilde;Q³¥%Y) #J3?f?·&Ocirc;&oslash;  &Agrave;+
?
?5!»??r?&Aacute;l
*RY8&uuml;?t{&auml;&Auml;2f& k²3§&igrave;?%?&igrave;&iuml;&Ograve;¡???&Euml;&Aring;!%§?R7Jx??&ucirc;?"&Agrave;
&oslash;`&Agrave; ?&Aacute;?&auml;¬ ?q&igrave;1?{1¡&Igrave;¤&atilde;&yuml; Q&Euml;??&Atilde; ??L
c&Agrave;&Agrave;iD&Ouml;JO? d &agrave;
<@id$?²²Q&Ograve;R??B24
? &oslash;b&Agrave;&Ccedil;
Ð&eth;G&uuml; 6JI?&auml;?
*

?b

v ,<aC?'?&Ecirc;FDtm£ªU&Uuml;&Agrave;Y0q:?V<t¢}? q\}&ocirc;&Agrave;'v/&THORN;&Egrave;[JMZatD&Ntilde;< 2³&ugrave;z&icirc;H&Ouml;H#&&Ocirc;b,_I¢+0|)16a
*"X£&Atilde;C ?1&¬
??O$#&uuml;Xbd&ocirc;kN&aring;v,??&Acirc;h&acirc;&Atilde;_?&Agrave;¡0°J&yacute;Ш!§%$"g%m?&oslash;k&agrave;y<_&Yacute;"&agrave;$0??? &thorn; ?&Ecirc;'P&Euml;C&icirc;??¿&agrave;K&thorn;?? ?~F"&Igrave;1&Auml;&Auml;&agrave;`X?/
?&Ucirc;·
&yacute;&Ograve;¡¼&Euml;1a??&oslash;
&Otilde;vNh}&egrave;0&Auml;;©¤&Euml;Tr&Eacute;&yacute;&Uuml;??Q&THORN;?~@0&uacute;j"1S>/&ucirc;²?&Ograve;ª"&iuml; &otilde;&Eacute;q_&Ntilde;?lu¹×|Z&Eacute;&ograve;?(?]&&Ucirc;?&ouml;ºm7}&Ntilde;IN]&Yacute;?]X¢&Icirc;p
*h0adÐ &Euml;
_#&Ucirc;r?¨?`|C!?|IX®y$w
aX?©&Agrave;&ucirc;&icirc;´uH
p&uacute;8&oslash;?DdPmq ?&Oslash;.9?&eacute;8tº"°&AElig;?&Ocirc;,m3&oslash;"?¬~&aelig;O
³¶AQ&Ucirc;&Iacute;?&ocirc;M&Oslash;I$£&aelig;mWca&Ucirc;?&yuml;&uuml;`»×G&Ntilde;:&Iacute; ??k%o°&AElig;*?¨1B:?l6?&Agrave;&Uuml;`&euml;?DA?&Oacute;?&euml;??®?&uacute;g
"?`&Acirc; &Oslash;²jy\hK¤??4@g&ocirc; 9
P¨
?w&aring;8&Ocirc;?ri
º! &ugrave;??
&agrave; &yuml;! &Eacute;¥5&szlig;?&agrave;6#&ugrave;GC&iuml;÷8?&Yacute;&auml;§@xH&ugrave;k?/A´@ ,'±&Ntilde;?&Egrave;?Q?A?&Iacute;&szlig;h©B :¢.?&Eacute;&yuml;&iuml;?0Q&aelig;VQ&Ecirc;&Oacute;g
?&ucirc;?&Ccedil;Lu¾&Iacute;¶&Atilde;c#&agrave;&ecirc;#&egrave;1(&Oslash;I?&aring;&Oslash;¸w<&Egrave;?e?¢.??*Q£&icirc;&Atilde; 1&ugrave;aP»3a?U&Ntilde;?Bµ]?So³(5&egrave;°?9&Ucirc;a??&yacute;¡÷5a?T.´&thorn;D&Ocirc;1 &Aacute;'?eC'&Eacute;6¢&Euml;@
"?`&Igrave;¶ GNm&uacute;?¸
?  Q&atilde;2?Q«(DYa?bº&Ouml;?Ð3&Otilde;&uacute;??&Atilde;@W´?&acirc;÷&Aacute;A%?&uacute;`n&Ouml;oW??&Otilde;ÐA¤Eq&acirc;,¡s&eacute;&egrave;?&aelig;G?
&aelig;¦&ucirc;?¥&Eacute;&Ecirc;??&agrave;
¨&Ecirc;Df=&ugrave;&Yacute;??&ntilde;&aacute;&Ocirc;IФ:?&Yacute;?&aacute; r1?×?´Db? A&?=G@4? 9Q?Bl8Ð&igrave;G&ouml;p&eth;&aring;?&Acirc;}? d°7&Oslash;?|IO&ouml;KR±8?\7&aelig;l&aacute;Jg?OD_??N³¨&Uuml;DB&Euml;©&ucirc;:?½?&Ocirc;D &Atilde;?u&Ucirc;A¼&egrave;?&Uacute;n¨&yacute;&Uuml;VU{&Egrave;&ntilde;§&/I&uacute;

 

[CTho9305]

n0c - no clue. its not my box. my machines work right (yeah, right ). I guess we dont rotate the logs, since they go back to the day he installed apache. why would this matter?

agamar - yeah, everyone here has logs full of code red, nimda, and variants. but thats not the odd part

n0c - any idea whats causing it though? the size (i copy/pasted) does not work out to any even multiple of the cluster size...

 

[n0cmonkey]

<< n0c - no clue. its not my box. my machines work right (yeah, right ). I guess we dont rotate the logs, since they go back to the day he installed apache. why would this matter? >>



It may not. It would have been easier to just download a sample though



<< agamar - yeah, everyone here has logs full of code red, nimda, and variants. but thats not the odd part

n0c - any idea whats causing it though? the size (i copy/pasted) does not work out to any even multiple of the cluster size... >>



No clue. I havent seen anything like it before.

 

[CTho9305]

<< No clue. I havent seen anything like it before. >>


i think i'll tell him to move to an NT or a *nix instead of win95 for the p150