Re: strange cmd.exe access

From: H Carvey <keydet89(at)yahoo.com>
Date: Fri May 30 2003 - 18:45:26 EDT

('binary' encoding is not supported, stored as-is)
In-Reply-To: <Pine.LNX.4.21.0305292008410.9010-100000@fist.ipdog.com>

>what is strange is that the cmd.exe / root.exe stuff is

It doesn't look at all as if you received an HTTP request, but as if some code was sent to port 80.

>the ip it hit was not mapped to anything ( I believe it

This doesn't make any sense...it has to be mapped to something, to a live machine. If it wasn't, how could the three-stage TCP handshake have been completed?

As someone else mentioned, it may be a follow-on packet to Code Red. Have you gone to this machine and checked the logs?

Harlan

---

---

Received on Mon Jun 2 00:59:01 2003