Strange log file entries

[baze22]

I had a space set up for a site, but hadn't gotten around getting the site online. In the mean time the server sat there with a "welcome to your new server" message. I just set up the site and was looking at teh log file that had accumulated and saw some strange entries. I haven't been able to find out much about them, does any body here have any clues?

200.32.3.102 - - [24/Jun/2004:07:41:28 +0000] "GET /scripts/nsiislog.dll" 404 - "-" "-"
211.242.65.73 - - [25/Jun/2004:02:55:26 +0000] "GET / HTTP/1.1" 400 396 "-" "-"
217.187.217.57 - - [26/Jun/2004:19:31:12 +0000] "HEAD / HTTP/1.0" 200 0 "-" "-"
218.104.125.54 - - [26/Jun/2004:20:45:49 +0000] "GET http://hpcgi1.nifty.com/trino/ProxyJ/prxjdg.cgi HTTP/1.1" 404 318 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)"
202.94.236.161 - - [27/Jun/2004:17:01:39 +0000] "GET /sumthin HTTP/1.0" 404 290 "-" "-"
80.37.231.63 - - [27/Jun/2004:20:25:01 +0000] "GET / HTTP/1.1" 200 1436 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
216.68.90.51 - - [27/Jun/2004:21:07:03 +0000] "GET /sumthin HTTP/1.0" 404 290 "-" "-"
211.161.122.93 - - [29/Jun/2004:11:09:33 +0000] "GET http://www.ebay.com/ HTTP/1.1" 200 1436 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)"
222.182.1.61 - - [29/Jun/2004:12:50:05 +0000] "CONNECT 64.156.215.19:25 HTTP/1.1" 405 332 "-" "-"
222.182.1.61 - - [29/Jun/2004:12:50:06 +0000] "GET http://www.ebay.com/ HTTP/1.1" 200 1436 "-" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
211.161.122.93 - - [01/Jul/2004:11:44:07 +0000] "GET http://hpcgi1.nifty.com/trino/ProxyJ/prxjdg.cgi HTTP/1.0" 404 306 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
203.64.118.88 - - [05/Jul/2004:06:58:48 +0000] "OPTIONS / HTTP/1.1" 200 - "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
193.225.118.78 - - [07/Jul/2004:20:13:08 +0000] "GET /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 404 - "-" "-"
165.229.66.75 - - [07/Jul/2004:20:26:51 +0000] "-" 408 - "-" "-"
61.189.223.211 - - [08/Jul/2004:00:30:13 +0000] "CONNECT 66.218.86.199:25 HTTP/1.1" 405 332 "-" "-"
61.189.223.211 - - [08/Jul/2004:00:30:13 +0000] "GET http://www.ebay.com/ HTTP/1.1" 200 1436 "-" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
67.234.73.88 - - [08/Jul/2004:10:19:53 +0000] "POST http://67.234.73.88:25/ HTTP/1.1" 405 329 "-" "-"
67.234.73.88 - - [08/Jul/2004:10:19:53 +0000] "CONNECT mailapps1-ext.prodigy.net:25 HTTP/1.0" 405 320 "-" "-"
217.82.117.213 - - [08/Jul/2004:18:30:44 +0000] "HEAD / HTTP/1.0" 200 0 "-" "-"
67.234.73.59 - - [08/Jul/2004:23:08:50 +0000] "CONNECT vme-ext.prodigy.net:25 HTTP/1.0" 405 320 "-" "-"
67.234.73.59 - - [08/Jul/2004:23:08:50 +0000] "POST http://67.234.73.59:25/ HTTP/1.1" 405 329 "-" "-"
218.90.187.11 - - [09/Jul/2004:10:08:22 +0000] "GET /scripts/root.exe?/c+dir" 404 - "-" "-"
221.186.88.90 - - [09/Jul/2004:16:43:25 +0000] "GET / HTTP/1.1" 200 1436 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
211.97.244.45 - - [10/Jul/2004:12:16:29 +0000] "CONNECT 216.136.129.5:25 HTTP/1.1" 405 332 "-" "-"
211.97.244.45 - - [10/Jul/2004:12:16:30 +0000] "GET http://www.ebay.com/ HTTP/1.1" 200 1436 "-" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
200.40.231.9 - - [10/Jul/2004:13:53:01 +0000] "HEAD / HTTP/1.0" 200 0 "-" "-"
218.55.183.2 - - [11/Jul/2004:23:41:07 +0000] "HEAD http://dir.yahoo.com/ HTTP/1.1" 200 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
212.235.112.162 - - [17/Jul/2004:23:06:37 +0000] "GET /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 404 - "-" "-"
80.181.157.236 - - [19/Jul/2004:02:30:57 +0000] "HEAD / HTTP/1.0" 200 0 "-" "-"
218.65.126.2 - - [20/Jul/2004:15:00:02 +0000] "\x04\x01" 501 - "-" "-"
218.65.126.2 - - [20/Jul/2004:15:00:10 +0000] "\x05\x01\x02" 501 - "-" "-"
211.72.53.6 - - [21/Jul/2004:08:36:07 +0000] "GET /sumthin HTTP/1.0" 404 290 "-" "-"
208.4.51.250 - - [21/Jul/2004:11:59:51 +0000] "HEAD / HTTP/1.0" 200 0 "-" "-"
218.87.95.46 - - [22/Jul/2004:03:33:57 +0000] "CONNECT 66.218.86.197:25 HTTP/1.1" 405 332 "-" "-"
218.87.95.46 - - [22/Jul/2004:03:33:58 +0000] "GET http://www.ebay.com/ HTTP/1.1" 200 1436 "-" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
161.139.127.3 - - [22/Jul/2004:05:02:18 +0000] "GET /sumthin HTTP/1.0" 404 290 "-" "-"
218.72.28.18 - - [22/Jul/2004:08:28:08 +0000] "CONNECT 66.135.208.101:80 HTTP/1.1" 405 334 "-" "-"
218.72.28.18 - - [22/Jul/2004:08:28:09 +0000] "GET http://www.ebay.com/ HTTP/1.1" 200 1436 "-" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
68.255.86.226 - - [23/Jul/2004:18:20:52 +0000] "ERR Just give me an error..." 400 390 "-" "-"

There are some that look like they are looking for apps, that in my case aren't there. Any help would be appreciated.

baze22

[psyon]

Looks like you have proxing enabled, and someone is abusing it and they are scanning for exploits.

[pas]

The "/scripts/..." ones are viruses on infected servers looking for other servers to infect.

[cianuro]

Yup, proxy scanners. Theres really nothing to worry about if your server is secure.

(Unless you want to get into the whole pros and cons of enabling/disabling proxy access in apache)