Apache server compromised?

lacerto · 04-13-2005, 04:27 AM

Hi
I was looking through my access_log this morning, and noticed the following:

[12/Apr/2005:18:52:13 +0100] "POST /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 401 1296 "-" "-"

Is this a security breech?

EDIT: A bit of further, more precise googling indicates that these are IIS worms, and of no concern to me.

Hangdog42 · 04-13-2005, 07:33 AM

Get used to seeing this kind of garbage in your logs. The number of infected IIS out there must be huge. Besides, note the 401 code which means that they didn't get any farther than POSTing the URL. For what it is worth, I believe this particular entry is looking for MS Front Page extentsions to play with.

Capt_Caveman · 04-13-2005, 07:47 AM

Anytime you see the .dll or .exe extensions in a URL like that, it's a good tip-off that it's a Windows exploit

lacerto · 04-13-2005, 03:26 PM

Thanks gents.