Kingslayer
08-07-01, 10:30 PM
I sent my IIS logs to Microsoft to troubleshoot a problem. They found entries in the logs from Codr Red scans and attacks aimed at flooding the memory buffers in the servers and gaining entrance.
Open your IIS logs. They should be located in root/winnt/logfiles...Open them up and do a find for cmd.exe. Now, before you get excited, some of these may be legit. Crystal Reports uses this command also. But if you see them, look for "ida" with out the quotes of course. Look for ida entries followed by a lenghty string of X's, A's or N's. This is the memory buffer attack.
Now here is the bad part. Do a search on the word worm. If you find any that aren't related to normal websites, you have been acsessed and infected.
Here is the really bad part. Microsoft told us that they, and the CERT teams, recommend formatting and reloading the server if this is found.
We took over 2000 hits on 3 servers in a 7 day period. We didn't even know that they were happening. Luckily, they didn't gain access. Must be they didn't have the patience to flood a Gig of memory.......
If the cmd.exe and the ida strings end in a negative error, 200, 401, 404, 403 they were denied entry.
Open your IIS logs. They should be located in root/winnt/logfiles...Open them up and do a find for cmd.exe. Now, before you get excited, some of these may be legit. Crystal Reports uses this command also. But if you see them, look for "ida" with out the quotes of course. Look for ida entries followed by a lenghty string of X's, A's or N's. This is the memory buffer attack.
Now here is the bad part. Do a search on the word worm. If you find any that aren't related to normal websites, you have been acsessed and infected.
Here is the really bad part. Microsoft told us that they, and the CERT teams, recommend formatting and reloading the server if this is found.
We took over 2000 hits on 3 servers in a 7 day period. We didn't even know that they were happening. Luckily, they didn't gain access. Must be they didn't have the patience to flood a Gig of memory.......
If the cmd.exe and the ida strings end in a negative error, 200, 401, 404, 403 they were denied entry.