httpd logs

[Mike Burger]

On Sat, 24 Dec 2005, Anze Vidmar wrote:

> hi!
>
> I have a mail server in the Internet somewhere.
> Every day, I keep getting this same error (404) logs for httpd (via
> LogWatch):
>
> --------------------- httpd Begin ------------------------
>
>
> Requests with error response codes
>    404 Not Found
>       /awstats/awstats.pl?configdir=|echo;echo%2 ... cho%20YYY;echo|: 3 Time(s)
>       /blog/xmlrpc.php: 3 Time(s)
>       /blog/xmlsrv/xmlrpc.php: 3 Time(s)
>       /blogs/xmlsrv/xmlrpc.php: 3 Time(s)
>       /cgi-bin/awstats.pl?configdir=|echo;echo%2 ... cho%20YYY;echo|: 3 Time(s)
>       /cgi-bin/awstats/awstats.pl?configdir=|ech ... cho%20YYY;echo|: 3 Time(s)
>       /cvs/index2.php?_REQUEST[option]=com_conte ... cho%20YYY;echo|: 1 Time(s)
>       /cvs/mambo/index2.php?_REQUEST[option]=com ... cho%20YYY;echo|: 1 Time(s)
>       /drupal/xmlrpc.php: 3 Time(s)
>       /favicon.ico: 31 Time(s)
>       /index.php?option=com_content&do_pdf=1&id= ... cho%20YYY;echo|: 1 Time(s)
>       /index2.php?option=com_content&do_pdf=1&id ... cho%20YYY;echo|: 1 Time(s)
>       /mambo/index2.php?_REQUEST[option]=com_con ... cho%20YYY;echo|: 1 Time(s)
>       /php/mambo/index2.php?_REQUEST[option]=com ... cho%20YYY;echo|: 1 Time(s)
>       /phpgroupware/xmlrpc.php: 3 Time(s)
>       /wordpress/xmlrpc.php: 3 Time(s)
>       /xmlrpc.php: 6 Time(s)
>       /xmlrpc/xmlrpc.php: 3 Time(s)
>       /xmlsrv/xmlrpc.php: 3 Time(s)
>
>
> worms?

Yeah, most likely some Windows boxes that have been infected, with 
something, and are out there, probing for vulnerable systems.
--
Mike Burger
http://www.bubbanfriends.org

Visit the Dog Pound II BBS
telnet://dogpound2.citadel.org or http://dogpound2.citadel.org

To be notified of updates to the web site, visit 
http://www.bubbanfriends.org/mailman/listinfo/site-update, or send a 
message to:

site-update-request at bubbanfriends.org

with a message of:

subscribe