Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to discover the nature of this, since it appears to be a relatively new phenomena and I don't know what it could mean (probably nothing good). The sign that I got of it was a long list of notices in my locally-hosted (non-internet enabled) Apache server's error log with messages like these (with increasing port numbers):

[Tue Dec 18 22:10:19.714000 2012] [access_compat:error] [pid 7076:tid 1592] [client 192.168.0.196:59424] AH01797: client denied by server configuration
[Tue Dec 18 22:11:41.922000 2012] [access_compat:error] [pid 7076:tid 1592] [client 192.168.0.196:59441] AH01797: client denied by server configuration
etc.

Where should I begin looking to figure out the nature of this?

Edit: I know the machine it's coming from, and I do have access to it if need be.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

You could start by checking out what program is doing the request. There's a PID mentioned, which is the process id of the application running. Since you have access to the client machine, you can look that up in Process Explorer / Task Manager and see the name of the process and application causing the log entry.

BTW: it's not necessarily malware or a virus causing this. Might simply be a network scan request, that is denied by your computer's policy.

Possibly related: http://stackoverflow.com/questions/12140559/error-with-htaccess-and-mod-rewrite

share|improve this answer
    
The pid in question (on my machine) is that of the Apache server itself, so I'll wager that's what it's referring to. What might be a good way to detect which process the network messages are coming from on the machine in question? –  Luxart Dec 19 '12 at 8:44
    
Ah yes, you're right of course; it's the Apache server itself. You could try out TcpView by the Microsoft-acquired SysInternals. It monitors all incoming and outcoming traffic over TCP/UDP, and might give you a hint where the messages originate from (application/user-wise). –  pleinolijf Dec 19 '12 at 9:54
add comment

Run a malware scanner such as Malwarebytes on the computer the requests are coming from.

Going along with the suggestion from pleinolijf, also run a virus scanner, such as Avast or AVG Free to ensure you cover all of your bases.

share|improve this answer
2  
Note that Malwarebytes is a malware scanner, and will not detect nor remove most viruses. Use a virus scanner for that (what's in a name eh?), like Avast!. Best is to scan using both a virus scanner and a malware scanner. –  pleinolijf Dec 19 '12 at 8:29
    
Thanks for the catch, I always say the wrong one. –  lexvegas Dec 19 '12 at 8:31
    
The computer in question has mcafee installed and scanning (includes a firewall and such), hasn't turned up anything yet... –  Luxart Dec 19 '12 at 8:32
1  
@lexvegas You can edit your answer to include the mention of a Virus Scanner. –  HaydnWVN Dec 19 '12 at 8:55
    
Thanks, Still getting used to the the format of superuser. –  lexvegas Dec 19 '12 at 13:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.