RE: IIS Logfile

["Eric McCarty" <eric () piteduncan com>]

NSIISLog.dll has a POST Overflow, that's my guess what they are trying
to do at this point in time. I would send abuse reports to their ISP's,
make sure you servers are patched and chalk it up to the lay of the
land.

Eric 

-----Original Message-----
From: mfernandez () fdta-valles org [mailto:mfernandez () fdta-valles org] 
Sent: Tuesday, October 26, 2004 1:07 PM
To: security-basics () securityfocus com
Subject: Re: IIS Logfile


Thanks to all of you for replying.

This log file is getting weirder. Here are more strange entries:

2004-10-26 01:04:22 202.38.216.127 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx
80 GET /scripts/nsiislog.dll - 401 5 0 - - -
2004-10-26 02:54:32 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx
80 GET /M83A - 401 5 0 - - -
2004-10-26 02:54:32 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx
80 PROPFIND / - 401 5 15 - TEST -
2004-10-26 02:54:33 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx
80 GET /scripts/nsiislog.dll - 401 5 0 xxx.xxx.xxx.xxx - -

I am located in the ass of the world (South America) and I don't
understand why some chinesse and sweden people should be interested on
my net? (those IPs are from that places)

Like you say, the 401 code means an authorization failure, but, what is
they trying to do?

Thanks in advance...





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.