Weard SEARCH requests in access_log

External Since: Jun 16, 2004 Posts: 3

Hello.

When looking in my log (the httpd - access_log), i found some weard
requests:

.... SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0.....
414 339 "-" "-"

The requests are very long (the above line is 28281 characters long!).
There are multiple of the same sort of the request, which are very
long and with a lot of "\x90". In the "error_log" i can see the
requests are rejected by httpd, by the log entry:"...request failed:
URI too long (longer than 8190)...".

But i am concerned about what it is. Does anyone know?

/Michael

External Since: Nov 03, 2003 Posts: 2907

Michael <ng1.TakeThisOut@mxn.dk> wrote:
> When looking in my log (the httpd - access_log), i found some weard
> requests:
> ... SEARCH /\x90\x02\xb1\x02\xb1\x02\xb<zap>
> 414 339 "-" "-"

Another worm/virus/junk trying to spread around, probably designed
for Microsoft machines. Put the originating IP in your firewall and
configure your Apache to not log this junk if you like.

Davide

--
| It is not true that life is one damn thing after another -- it's one
| damn thing over and over.
|
|