| ezmiller 2007-05-04, 1:20 pm |
| Hi,
I run a FTP server on IIS 5.1 (in XP) and lately my logs show that a
wide range of IPs have been accessing the ftp account through an
anonymous log on. I know htat I can close down anonymous access to
the FTP server but I wonder if there is another way to counter act
this? I also wonder whether anyone can shed light on why and what the
people are trying to do to or with my computer. They have created a
bunch of nonsense directories, some of which, strangely, I have been
unable to delete and appear to have no name. I am going to post a
segment of the log below just as an example. Any help would be
greatly appreciated.
04:39:21 81.35.47.40 [44]USER anonymous 331
04:39:21 81.35.47.40 [44]PASS flashfxp-user@flashfxp.com 230
04:39:34 81.35.47.40 [44]sent /Si42/++Lpt2+/++Lpt2+/++Lpt2+/++Lpt2+/
here/_+/Scan+by+d@nt@n@+/Tagged+/By+d@nt@n@+/UP+/by++d@nt@n@/for/
Exodus/Ultim@te/Stomp.The.Yard.sfv 226
04:39:37 81.35.47.40 [44]sent /Si42/++Lpt2+/++Lpt2+/++Lpt2+/++Lpt2+/
here/_+/Scan+by+d@nt@n@+/Tagged+/By+d@nt@n@+/UP+/by++d@nt@n@/for/
Exodus/Ultim@te/Stomp.The.Yard.sfv 226
04:39:37 81.35.47.40 [44]sent /Si42/++Lpt2+/++Lpt2+/++Lpt2+/++Lpt2+/
here/_+/Scan+by+d@nt@n@+/Tagged+/By+d@nt@n@+/UP+/by++d@nt@n@/for/
Exodus/Ultim@te/Stomp.The.Yard.001 226
05:01:39 81.35.47.40 [44]sent /Si42/++Lpt2+/++Lpt2+/++Lpt2+/++Lpt2+/
here/_+/Scan+by+d@nt@n@+/Tagged+/By+d@nt@n@+/UP+/by++d@nt@n@/for/
Exodus/Ultim@te/Stomp.The.Yard.001 226
05:01:41 81.35.47.40 [44]sent /Si42/++Lpt2+/++Lpt2+/++Lpt2+/++Lpt2+/
here/_+/Scan+by+d@nt@n@+/Tagged+/By+d@nt@n@+/UP+/by++d@nt@n@/for/
Exodus/Ultim@te/Stomp.The.Yard.002 226
05:36:40 81.35.47.40 [44]sent /Si42/++Lpt2+/++Lpt2+/++Lpt2+/++Lpt2+/
here/_+/Scan+by+d@nt@n@+/Tagged+/By+d@nt@n@+/UP+/by++d@nt@n@/for/
Exodus/Ultim@te/Stomp.The.Yard.002 226
05:36:42 81.35.47.40 [44]sent /Si42/++Lpt2+/++Lpt2+/++Lpt2+/++Lpt2+/
here/_+/Scan+by+d@nt@n@+/Tagged+/By+d@nt@n@+/UP+/by++d@nt@n@/for/
Exodus/Ultim@te/Stomp.The.Yard.003 226
05:40:01 213.251.189.201 [45]
|