Your Ad Here

Monday, March 9, 2009

Weird apache log?

I run an Apache test server on localhost and I was browsing the web and I went to some image site that had a virus that my scanner caught and blocked (I hope all the way). I didnt think much of it, but a few minutes later I went looking through my apache logs because my website threw an error and I found a ton of requests to my server like this, coming from my own machine:

access.log wrote:
127.0.0.1 - - [08/Mar/2009:03:01:45 -0400] "GET /imp?Z=160x600,120x600&s=511547&t=2 HTTP/1.1" 404 201
127.0.0.1 - - [08/Mar/2009:03:01:46 -0400] "GET /imp?Z=728x90&S=INSERT_SECTION_CODE_HERE&i=287962&t=2 HTTP/1.1" 404 201
127.0.0.1 - - [08/Mar/2009:03:01:46 -0400] "GET /imp?Z=300x250&S=INSERT_SECTION_CODE_HERE&i=287962&t=2 HTTP/1.1" 404 201
127.0.0.1 - - [08/Mar/2009:03:01:46 -0400] "GET /imp?Z=160x600&S=INSERT_SECTION_CODE_HERE&i=287962&t=2 HTTP/1.1" 404 201
127.0.0.1 - - [08/Mar/2009:03:01:47 -0400] "GET /c?e1=<some encoded information was here, but I removed it from this post> HTTP/1.1" 404 199
127.0.0.1 - - [08/Mar/2009:03:01:49 -0400] "GET /imp?Z=728x90,468x60&s=511547&t=2 HTTP/1.1" 404 201
127.0.0.1 - - [08/Mar/2009:03:01:50 -0400] "GET /imp?Z=300x250&s=511547&t=2 HTTP/1.1" 404 201
127.0.0.1 - - [08/Mar/2009:03:01:50 -0400] "GET /rd/Clk.jsp?s=m3&k=vacation+rental&lnk2=<some encoded information was here, but I removed it from this post> HTTP/1.1" 404 208
127.0.0.1 - - [08/Mar/2009:03:01:52 -0400] "GET /imp?Z=160x600,120x600&s=511547&t=2 HTTP/1.1" 404 201
127.0.0.1 - - [08/Mar/2009:03:01:52 -0400] "GET /imp?Z=160x600&S=INSERT_SECTION_CODE_HERE&i=287962&t=2 HTTP/1.1" 404 201
127.0.0.1 - - [08/Mar/2009:03:01:52 -0400] "GET /imp?Z=468x60&S=INSERT_SECTION_CODE_HERE&i=287962&t=2 HTTP/1.1" 404 201


Was/is it a virus on my machine? It seems like it was some sort of crafty script or something that made FireFox run queries on localhost.

The only thing I could find related to it was when I did a google search on "INSERT_SECTION_CODE_HERE" I found this: http://www.spywarelib.com/SpywareDetail ... bancos.abv

Note: I removed some of the characters from the URLs with encoded strings incase they had some sort of information about my machine.

Read More...
Your Ad Here

No comments: