[stalk:01066] IIS exploit attempt ? frontpage extension ?

[Hiroshi Tsukamoto <hirobo-ml@xxxxxxx>]

塚本です

bbtec.netから変なアクセスが続いて来ます

12-04 23:52:58 43.225.**.** read ./spam.h1r.org/blacklists.html: success
12-04 23:52:59 43.225.**.** read ./spam.h1r.org/_vti_bin/owssvr.dll: open failed: file does not exist
12-04 23:53:01 43.225.**.** read ./spam.h1r.org/MSOffice/cltreq.asp: open failed: file does not exist
12-04 23:54:23 43.225.**.** read ./spam.h1r.org/blacklists.html: success
12-04 23:54:24 43.225.**.** read ./spam.h1r.org/_vti_bin/owssvr.dll: open failed: file does not exist
12-04 23:54:24 43.225.**.** read ./spam.h1r.org/MSOffice/cltreq.asp: open failed: file does not exist
12-04 23:55:02 43.225.**.** read ./spam.h1r.org/_vti_bin/owssvr.dll: open failed: file does not exist
12-04 23:55:03 43.225.**.** read ./spam.h1r.org/MSOffice/cltreq.asp: open failed: file does not exist
12-04 23:55:37 43.225.**.** read ./spam.h1r.org/_vti_bin/owssvr.dll: open failed: file does not exist
12-04 23:55:37 43.225.**.** read ./spam.h1r.org/MSOffice/cltreq.asp: open failed: file does not exist
12-04 23:57:55 43.225.**.** read ./spam.h1r.org/_vti_bin/owssvr.dll: open failed: file does not exist
12-04 23:57:56 43.225.**.** read ./spam.h1r.org/MSOffice/cltreq.asp: open failed: file does not exist

これはなんなのでしょう？  普通のアクセスとまじってるんですけど。

User-Agentは:
 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

なにかの誤操作のような感じがするのですが。

あ、これはhttpdのログです。(笑

-- 
塚本  弘
--
- このメイリングリストに関する質問・問い合せ等は
- <security-talk@xxxxxxxxxx>までお知らせください
--
------------------------------------------------------------------------
　　　　　　　　　今流行りの「Badtrans」って知ってる？　　　　　　　　　
　　 　 http://www.infoseek.co.jp/Titles?qt=Badtrans&svx=971122