annoying popups

Hi,

I've noticed that in the past week, an extremely annoying popup with ads
shows up when my site is visited. The ad appears to be random. Is
there a way for me to systematically go through and find out what is
causing it?

What logs/scripts/files are likely to be causing the problem. I've got
a "TagBoard" on my site (from www.tagboard.com). Could that be what's
causing it? I have no clue at this point. I've checked access.log and
other files in /var/log/apache, but nothing too suspicious. I always
get this:
[Sun Nov 9 08:56:49 2003] [error] [client 67.164.69.171] File does not
exist: /var/www/scripts/..%2f../winnt/system32/cmd.exe
in my access.log.
Thanks for any help.

-jd

I don't know about your pop-ups, but I believe that your server log entry:

... [error] ... File does not exist:
/var/www/scripts/..%2f../winnt/system32/cmd.exe

indicates that a worm has tried to attack you. Its trying to exploit a hole
in Microsoft IIS and other than cluttering you logs you can ignore it if you
are running Apache. If you are feeling kind then you could try to inform the
administrator at the site from which the attack originated, because he/she
is probably unaware that they have been infected by a worm.

Hope it helps,

Brian.


"John Doe" <john@doe.com> wrote in message
news:zs6dnRpoOoRR5DOiRVn-jA@comcast.com...
> Hi,
>
> I've noticed that in the past week, an extremely annoying popup with ads
> shows up when my site is visited. The ad appears to be random. Is
> there a way for me to systematically go through and find out what is
> causing it?
>
> What logs/scripts/files are likely to be causing the problem. I've got
> a "TagBoard" on my site (from www.tagboard.com). Could that be what's
> causing it? I have no clue at this point. I've checked access.log and
> other files in /var/log/apache, but nothing too suspicious. I always
> get this:
> [Sun Nov 9 08:56:49 2003] [error] [client 67.164.69.171] File does not
> exist: /var/www/scripts/..%2f../winnt/system32/cmd.exe
> in my access.log.
> Thanks for any help.
>
> -jd

In article <1068655433.64662.0@iris.uk.clara.net>, Brian Cryer wrote:
> I don't know about your pop-ups, but I believe that your server log entry:
>
> ... [error] ... File does not exist:
> /var/www/scripts/..%2f../winnt/system32/cmd.exe
>
> indicates that a worm has tried to attack you. Its trying to exploit a hole
> in Microsoft IIS and other than cluttering you logs you can ignore it if you
> are running Apache. If you are feeling kind then you could try to inform the
> administrator at the site from which the attack originated, because he/she
> is probably unaware that they have been infected by a worm.
>
> Hope it helps,
>
> Brian.

Thanks. As for the popups... I found out that it *is* the TagBoard
guestbook that is causing it.
It's a nice, easy to use message board type thing... but apparently
should be avoided. Their website said nothing about these pop ups, but
Google revealed that I'm not the only one with this observation.
I will probably remove it soon.
Regards,
jd