Web Hosting Forum | Lunarpages
News: Server Migrations to San Diego: Deneb, Felix and Tsohea are moving to San Diego starting Tuesday, December 30, 2008 at 10pm Pacific. They will complete their moves Friday night, January 2, 2009

Isis, Seth and Ez-web-n-mail will move physically on Friday, January 2, 2009

Please see the forum posts at http://www.lunarforums.com/lunarpages_web_hosting_server_information-b54.0/

+ Submit Your Own Web Site for the January 2009 Site of the Month Contest!
 
*
Welcome, Guest. Please login or register.
Did you miss your activation email?
January 07, 2009, 07:12:01 PM


Login with username, password and session length


Pages: [1]   Go Down
  Print  
Author Topic: Hacking attempt on website gifs?  (Read 774 times)
yave20b
Trekkie
**
Offline Offline

Posts: 12


« on: April 07, 2008, 01:42:46 AM »

I got 6 error messages this evening from my website as follows:

Sun Apr  6 23:41:46 2008] [error] [client 66.174.92.169] File does not exist: /home/xxxx/public_html/images/general/hospital_small.gif.vco_2_4000_64_vco
[Sun Apr  6 23:41:46 2008] [error] [client 66.174.92.169] File does not exist: /home/xxxx/public_html/images/general/riverwalk1.jpg.vco_3_4000_70_vco
[Sun Apr  6 23:41:46 2008] [error] [client 66.174.92.169] File does not exist: /home/xxxx/public_html/javascript/global_java.js.vco_4_2_0_vco
[Sun Apr  6 23:41:46 2008] [error] [client 66.174.92.169] File does not exist: /home/xxxx/public_html/images/general/fireman_small.gif.vco_2_4000_64_vco
[Sun Apr  6 23:41:45 2008] [error] [client 66.174.92.169] File does not exist: /home/xxxx/public_html/images/general/christmas_tree_small.gif.vco_2_4000_64_vco
[Sun Apr  6 23:41:45 2008] [error] [client 66.174.92.169] File does not exist: /home/xxxx/public_html/images/general/jl_icon1.gif.vco_2_4000_64_vco

This guy went through lots and lots of my gifs according to my log files.  But he tried to run the "vco...."thing on these 5 gifs and one of my javascript files, which generated the 404 error messages.  I can't find anything on Google about the "vco...." thing.  I'm sure he was up to know good as I had an http insertion attack attempt on my website this morning but my blocks I have in my .htaccess file stopped that.  He also went through my SMF files, looking at lots of the gifs and javascript files there. 

Does anyone know what he was attempting to accomplish with the "vco...."thing? Thanks for any info.

Logged
Mitch
Lunarpages Traffic Cop
Senior Moderator
Berserker Poster
*****
Offline Offline

Posts: 8934



WWW
« Reply #1 on: April 07, 2008, 05:40:35 AM »

Very weird, looks like they were scanning you for some type of file and didn't find it.  First I have heard about vco (Google didn't tell me much either) but I'll keep searching and let you know if I find anything like this talked about elsewhere.  Thumbs Up
Logged

Foolish Mitch the Moderator

+ Important Threads and Posts: Read This Before Posting! | Lunarforums Rules!
+ Lunarforums Fun: Submit Your URL to or Vote for the Site of the Month!

Also, be sure to check out and subscribe to the Lunartics Blog and the Lunarpages Newsletter !
yave20b
Trekkie
**
Offline Offline

Posts: 12


« Reply #2 on: April 07, 2008, 09:43:19 AM »

Thanks Mitch.  I checked my files as best I can and can't see anything that was changed. 
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.6 | SMF © 2006-2008, Simple Machines LLC

Valid XHTML 1.0! Valid CSS! Dilber MC Theme by HarzeM