Re: error logs

Hi Jim,

I just used www.network-tools.com to do a reverse DNS lookup and found that
199.227.45.130 is mail.rooftile.com.  Possibly their mail server was
infected by something?

Peter Dow
Dow Software Services, Inc.
909 425-0194 voice
909 425-0196 fax


----- Original Message -----
From: "Jim Franz" <franz400@triad.rr.com>
To: <web400@midrange.com>
Sent: Monday, December 03, 2001 7:50 PM
Subject: Re: [WEB400] error logs


> Don't have any Front Page in our web pages. All is pure html 4 from
rpg/cgi.
> I suspect someone is regularly probing.
> jim franz
>
> ----- Original Message -----
> From: "Rich Duzenbury" <rduz@westernmidrange.com>
> To: <web400@midrange.com>
> Sent: Monday, December 03, 2001 10:46 PM
> Subject: Re: [WEB400] error logs
>
>
> > The _vti* directories are annoying FrontPage parlance.  Could be that
the
> > file exists, and someone is trying to exec it, which should not work
(e.g.
> > running win32 console code on AS/400).  Was the initial web created by
> > FrontPage?
> >
> > FP seems to create these _vti* directories underneath every directory in
> > your web.  It was one of the (many) reasons we switched to
> > DreamWeaver.  Another reason was that we couldn't get the FP extensions
> > installed and working on a Non-Windows box, although it was supposed to
be
> > supported.
> >
> > The problem is that even if you delete those directories (one by one),
if
> > the web is re-published, they will all reappear again.
> >
> > Or,  someone found a FP hack that they keep trying, similar to the code
> red
> > and Nimda hits you are familiar with.
> >
> > Regards,
> > Rich
> >
> > At 09:23 PM 12/3/01, you wrote:
> > >This is a multi-part message in MIME format.
> > >--
> > >[ Picked text/plain from multipart/alternative ]
> > >In addition to the normal Red Worm or Nimda junk, I see this
> > >from only this one address. What bothers me is the "input timer
expired"
> > >msg, like it actually tried to execute something.
> > >The wwwaccess log has nothing for this address (thanks!).
> > >This one address is banging on my system regularly since July. Is it a
> web
> > >crawler?
> > >
> > >[28/Nov/2001:10:01:23 +0000]FORBIDDEN BY
> > >RULE   199.227.45.130              /bnc
> > >[28/Nov/2001:10:01:24 +0000]FORBIDDEN BY
> > >RULE   199.227.45.130              /_vti_inf.html
> > >[28/Nov/2001:10:01:25 +0000]FORBIDDEN BY
> > >RULE   199.227.45.130              /_vti_bin/shtml.exe/_vti_rpc
> > >[28/Nov/2001:10:05:55 +0000]Input timer expired 199.227.45.130
> >
> > _______________________________________________
> > This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> > To post a message email: WEB400@midrange.com
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/cgi-bin/listinfo/web400
> > or email: WEB400-request@midrange.com
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/web400.
> >
> >
>
>
> _______________________________________________
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/web400
> or email: WEB400-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.


_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com