Windows Forum

Ask something
Discussion Locked

deciphering urlscan logs

0 helpful
5 replies

by jpatel

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have installed the new Urlscan app from microsoft. In less than 24 hours I have denied more than 5500 requests from more than 360 different IP addresses. Whats going on here and should I be worried or relieved? Is there something else that I needto look into?

5 replies

by jpatel

I have looked at what Microsoft has posted, including the article Q307608. Maybe if I mention that the web requests mostly seem to be for root.exe and cmd.exe URL's in the scripts directory that will help. It seems to me that this is a remnant of CodeRed, but why so many requests still coming in?

by jpatel

You all lose. The logs were growing as a result of the Nimda Virus. The virus uses the same backdoor as the CodeRed Worm. Nimda was trying to hack the webserver.... HAHAHAHa No way. closing the topic.

This discussion is closed to new replies.