Dargar
04-29-2002, 02:52 PM
I use CPanel v3.0 and in the error logs I find this error alot
[error] File does not exist: /public_html/scripts/..%2f../winnt/system32/cmd.exe
But what is strange about that is that it points to my IP address??? Why
What does is this error message refering too? My site is hosted with a company so I don't control the servers and configuration
Thanks
(SH)Saeed
04-29-2002, 02:57 PM
Some asked almost the same question a couple of days ago..
http://www.webhostingtalk.com/showthread.php?s=&threadid=47148
Dargar
04-29-2002, 03:03 PM
ok got it... I just did a little more searching and found more information about it...but what I still don't understand is that the IP address is refering to my company where I work? We do have IIS 4.0 installed on our network for our intranet. Do you think our IIS serever my be probing my site?
GHDpro
04-29-2002, 04:46 PM
1) I guess you know already - what you find in your logs can only
affect Windows servers - Linux is totally immune. So apart from the
extra load & traffic, no problem.
2) If the IP that caused this is from your intranet server, then yes,
it's infected and it's about time to patch it & eliminate whatever it's
infected with, "Code Red" I guess, unless their have been newer
virusses which leave "cmd.exe" hits in the logs..
Search the Microsoft site for "Code Red" for more info...
Dargar
04-30-2002, 07:48 AM
Yeah that is strange... we did patch it awhile back for CODE RED and ran the norton fix to clean it out... I guess we need to take a second look again.. I do know that there are a couple of different viruses like this and you have to run different fixes...that might be what it is...
thanks for the info.
-Darren
rivnus
04-30-2002, 08:17 PM
you IIS server is most likely infected by code red.
I doubt if they are "probing" your site.