Don't have any Front Page in our web pages. All is pure html 4 from rpg/cgi. I suspect someone is regularly probing. jim franz ----- Original Message ----- From: "Rich Duzenbury" <email@example.com> To: <firstname.lastname@example.org> Sent: Monday, December 03, 2001 10:46 PM Subject: Re: [WEB400] error logs > The _vti* directories are annoying FrontPage parlance. Could be that the > file exists, and someone is trying to exec it, which should not work (e.g. > running win32 console code on AS/400). Was the initial web created by > FrontPage? > > FP seems to create these _vti* directories underneath every directory in > your web. It was one of the (many) reasons we switched to > DreamWeaver. Another reason was that we couldn't get the FP extensions > installed and working on a Non-Windows box, although it was supposed to be > supported. > > The problem is that even if you delete those directories (one by one), if > the web is re-published, they will all reappear again. > > Or, someone found a FP hack that they keep trying, similar to the code red > and Nimda hits you are familiar with. > > Regards, > Rich > > At 09:23 PM 12/3/01, you wrote: > >This is a multi-part message in MIME format. > >-- > >[ Picked text/plain from multipart/alternative ] > >In addition to the normal Red Worm or Nimda junk, I see this > >from only this one address. What bothers me is the "input timer expired" > >msg, like it actually tried to execute something. > >The wwwaccess log has nothing for this address (thanks!). > >This one address is banging on my system regularly since July. Is it a web > >crawler? > > > >[28/Nov/2001:10:01:23 +0000]FORBIDDEN BY > >RULE 18.104.22.168 /bnc > >[28/Nov/2001:10:01:24 +0000]FORBIDDEN BY > >RULE 22.214.171.124 /_vti_inf.html > >[28/Nov/2001:10:01:25 +0000]FORBIDDEN BY > >RULE 126.96.36.199 /_vti_bin/shtml.exe/_vti_rpc > >[28/Nov/2001:10:05:55 +0000]Input timer expired 188.8.131.52 > > _______________________________________________ > This is the Web Enabling the AS400 / iSeries (WEB400) mailing list > To post a message email: WEB400@midrange.com > To subscribe, unsubscribe, or change list options, > visit: http://lists.midrange.com/cgi-bin/listinfo/web400 > or email: WEB400email@example.com > Before posting, please take a moment to review the archives > at http://archive.midrange.com/web400. > >
As an Amazon Associate we earn from qualifying purchases.
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.