Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to discover the nature of this, since it appears to be a relatively new phenomena and I don't know what it could mean (probably nothing good). The sign that I got of it was a long list of notices in my locally-hosted (non-internet enabled) Apache server's error log with messages like these (with increasing port numbers):

[Tue Dec 18 22:10:19.714000 2012] [access_compat:error] [pid 7076:tid 1592] [client 192.168.0.196:59424] AH01797: client denied by server configuration
[Tue Dec 18 22:11:41.922000 2012] [access_compat:error] [pid 7076:tid 1592] [client 192.168.0.196:59441] AH01797: client denied by server configuration
etc.

Where should I begin looking to figure out the nature of this?

Edit: I know the machine it's coming from, and I do have access to it if need be.

share|improve this question
up vote 3 down vote accepted

You could start by checking out what program is doing the request. There's a PID mentioned, which is the process id of the application running. Since you have access to the client machine, you can look that up in Process Explorer / Task Manager and see the name of the process and application causing the log entry.

BTW: it's not necessarily malware or a virus causing this. Might simply be a network scan request, that is denied by your computer's policy.

Possibly related: http://stackoverflow.com/questions/12140559/error-with-htaccess-and-mod-rewrite

share|improve this answer
    
The pid in question (on my machine) is that of the Apache server itself, so I'll wager that's what it's referring to. What might be a good way to detect which process the network messages are coming from on the machine in question? – Luxart Dec 19 '12 at 8:44
    
Ah yes, you're right of course; it's the Apache server itself. You could try out TcpView by the Microsoft-acquired SysInternals. It monitors all incoming and outcoming traffic over TCP/UDP, and might give you a hint where the messages originate from (application/user-wise). – pleinolijf Dec 19 '12 at 9:54

Run a malware scanner such as Malwarebytes on the computer the requests are coming from.

Going along with the suggestion from pleinolijf, also run a virus scanner, such as Avast or AVG Free to ensure you cover all of your bases.

share|improve this answer
2  
Note that Malwarebytes is a malware scanner, and will not detect nor remove most viruses. Use a virus scanner for that (what's in a name eh?), like Avast!. Best is to scan using both a virus scanner and a malware scanner. – pleinolijf Dec 19 '12 at 8:29
    
Thanks for the catch, I always say the wrong one. – Viertaxa Dec 19 '12 at 8:31
    
The computer in question has mcafee installed and scanning (includes a firewall and such), hasn't turned up anything yet... – Luxart Dec 19 '12 at 8:32
1  
@lexvegas You can edit your answer to include the mention of a Virus Scanner. – HaydnWVN Dec 19 '12 at 8:55
    
Thanks, Still getting used to the the format of superuser. – Viertaxa Dec 19 '12 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .