From owner-freebsd-questions Sat Jan 19 20:31:21 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mail.27in.tv (roc-66-24-112-7.rochester.rr.com [66.24.112.7]) by hub.freebsd.org (Postfix) with ESMTP id DA25137B405 for ; Sat, 19 Jan 2002 20:31:12 -0800 (PST) Received: (from root@localhost) by mail.27in.tv (8.11.6/8.11.6) id g0K4VAi12406; Sat, 19 Jan 2002 23:31:10 -0500 (EST) (envelope-from cjm2@earthling.net) Received: from maxpower (trilluser@maxpower.lan.27in.tv [10.0.0.250]) by mail.27in.tv (8.11.6/8.11.6av) with SMTP id g0K4V8U12392; Sat, 19 Jan 2002 23:31:09 -0500 (EST) (envelope-from cjm2@earthling.net) From: "C J Michaels" To: "pirat" Cc: Subject: RE: strange apache log output Date: Sat, 19 Jan 2002 23:31:18 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 In-Reply-To: <20020120094603.A16651@radwaste.oaep.go.th> Importance: Normal X-Virus-Scanned: by AMaViS perl-11 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG It means that the system at 203.155.64.7 is infect with the Nimda worm and it is trying to spread it to you. It's harmless to apache (except for flooding your logs). http://www.cert.org/advisories/CA-2001-26.html Specifically that line is saying that a client at IP 203.155.64.7 @ the given date/time requested the file "/scripts/root.exe?/c+dir", and was returned error 404 (which means the page doesn't exist). --Chris > -----Original Message----- > From: owner-freebsd-questions@FreeBSD.ORG > [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of pirat > Sent: Saturday, January 19, 2002 9:46 PM > To: questions@FreeBSD.ORG > Subject: strange apache log output > > > hi sirs, > > i've run apache in my machine, FreeBSD-4.4 stabled, and most of > entry in the log file output is > > 203.155.64.7 - - [20/Jan/2002:09:21:05 +0700] "GET > /scripts/root.exe?/c+dir HTTP/1.0" 404 276 "-" "-" > > what does it mean and sometime the code is 400 instead of 404 > > please cc to me since i do not subscribe to this list. > > many thanks in advance. > > with best regards, > psr > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message