"/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe " what does that mean? I find shit like that in my "Documents not found" stats. wtf is that?

is that on a server? are you on a windows box?

It's a Code Red virus attack, are you running a windows server?

If you are there's some info and links to help here:
http://www.serverautomationtools.com/webcg...ntain-this.html

good call trev and then you say i am a techie jajajaja.



NickPapa is that server yours (as in dedicated) or is that your customer´s server the one that we had problems getting cdonts to work.

at any rate he needs to patch it up. if you need an nt box thats secure (as secure as bill gates and his crew of numbnuts can get it cause you never know what comes up) i have one that you can host your stuff in. mine is pretty stable and it is always being checked by me and updated....

no virus attacks yet. only one hack and it was a customers fault but i fixed it :)


if you need someone to patch your box LMK I will need remote dektop access.

It's on Webair's server. Are they windows servers?

Here are all of the odd ones from this month:

/scripts/..%5c../winnt/system32/cmd.exe
/scripts/..À¯../winnt/system32/cmd.exe
/scripts/..Áœ../winnt/system32/cmd.exe
/scripts/..%2f../winnt/system32/cmd.exe
/scripts/root.exe
/MSADC/root.exe
/c/winnt/system32/cmd.exe
/d/winnt/system32/cmd.exe
/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
/msadc/..%5c../..%5c../..%5c/..Á ../..Á ../..Á ../winnt/system32/cmd.exe
/scripts/..Á ../winnt/system32/cmd.exe
/scripts/..À/../winnt/system32/cmd.exe
/_vti_bin/owssvr.dll
/MSOffice/cltreq.asp

If it's webair's server, isn't it their responsibility to correct this if it's a problem? If not, I need help lol. What happens from this anyway? I am no techie so lamens terms would be great.
:inlove:

ok so if hackers find the root.exe file they can get in my server and do some nasty shit. As long as root.exe is coming up 404 though, I should be ok right?

hmmm...with it being a virtual account hosted by webair I don't think I have access to the actual log files to see if these returned 404 or 200. Should I contact them and let them know what's going on?

I would contact them, as it's a virtual setup it's their worry and not yours because you don't have the access to the server that they have. Plus they'll let you know if your server is windows or not.

even if it is not windows they have a big security breach there.

and if it is windows they are sucking ass.


yes they are the ones responsible, just as we are with all virtual hosting. infact even on dedicated boxes we lend a hand if we find out it was our config problem.

commonnn webair thought you guys were better than that :)

however, it may be a worm trying to get to that server but it is weird cause ussually the worms won't even try if it is not windows.

If it was in the documents not found section of your report, then it was a 404.

I have across the years recieved many code red type attempts coming in. I don't know if code red is smart enought to know if it is a win server or not, but there are definitely things coming in like that that DO NOT realize that they are against a NIX server.

For the most part they can be ignored on a NIX box.

Since they are getting 404 on your box, then it is either a nix box or a patched Win box.

just imho of course.

Meh...fuck tech support.

"Matt
Hello and welcome to Webair Live! What can I help you with today?
Lee Carey
Hey Matt. I don't know if this should be a concern or not but I figured I would send it in anyway. I keep getting this in my "Documents not found" stats:
Lee Carey
/scripts/..%5c../winnt/system32/cmd.exe
/scripts/..À¯../winnt/system32/cmd.exe
/scripts/..Áœ../winnt/system32/cmd.exe
/scripts/..%2f../winnt/system32/cmd.exe
/scripts/root.exe
/MSADC/root.exe
/c/winnt/system32/cmd.exe
/d/winnt/system32/cmd.exe
/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
/msadc/..%5c../..%5c../..%5c/..Á ../..Á ../..Á ../winnt/system32/cmd.exe
/scripts/..Á ../winnt/system32/cmd.exe
/scripts/..À/../winnt/system32/cmd.exe
Lee Carey
From what I understand it's the Code Red virus attack and if the root.exe comes back as 200 hackers can gain access to my server or you guys server or the box or something lol. I am no tech, so I thought I would bring it to you guys.
Matt
What machine is this Lee?
Lee Carey
It's on pornpapa.com
Matt
Lee your are on a shared unix based server.
Matt
I do not see how this has anything to do with such?
Lee Carey
No idea Matt. I just asked around on Oprano what I should do this morning if I see that in my stats because I thought it was sort of strange and they said to contact you guys and let you know it's going on.
Lee Carey
I know nothing about how any of it works at all.
Matt
It is not even in the scope of being a security concern on our end.
Lee Carey
Alright then everything is cool then?
Matt
The code red virus is a worm from 3 years ago that was exclusively limited to windows machine. I don't see how this would be relevant at all?
Lee Carey
Well Matt...I saw the stats, I thought it was strange, and since I am on a virtual account, I figured I would contact you guys just incase. I don't know how the worm works, or if it was relevant. I don't keep up with worms and server stuff."

Well at least you know you're not on a windows box :)


That service rep sounds fucking sucky though <_<

Sucky customer service. what happened to service with a smile.

told you to move your stuff to me LOL

I'm coming over soon bro. :) Got alot going on right now so time constraints are fucking with me but soon.

Hmmm...maybe it's time for all the newbies on Oprano to go in together and get a nice fast box with Inabon and share it amongst themselves...

I got off a shared server because I was tired of other people (on the server) screwing things up for me and not having any real recourse against them.

Now, if I knew everyone else that was on the box, so I could get with the person fucking up real fast, I might just drop back to a shared box just for the money savings...

just a thought, ya know.

I think it a damn good idea :okthumb:


don't let NickPapageorgio know though or you'll become his tech support :lol:

hey i can do that. the way we config boxes are pretty stable we don´t have that many issues on our shared hosting boxes. basically the main problem with shared is when people use dbases. sucky queries and databases sometimes bog down the box but we are pretty good at finding them. and fixing

I so have sucky queries and databases :groucho: