2

I'm trying to discover the nature of this, since it appears to be a relatively new phenomena and I don't know what it could mean (probably nothing good). The sign that I got of it was a long list of notices in my locally-hosted (non-internet enabled) Apache server's error log with messages like these (with increasing port numbers):

[Tue Dec 18 22:10:19.714000 2012] [access_compat:error] [pid 7076:tid 1592] [client 192.168.0.196:59424] AH01797: client denied by server configuration
[Tue Dec 18 22:11:41.922000 2012] [access_compat:error] [pid 7076:tid 1592] [client 192.168.0.196:59441] AH01797: client denied by server configuration
etc.

Where should I begin looking to figure out the nature of this?

Edit: I know the machine it's coming from, and I do have access to it if need be.

Improve this question

2 Answers 2

Reset to default
3

You could start by checking out what program is doing the request. There's a PID mentioned, which is the process id of the application running. Since you have access to the client machine, you can look that up in Process Explorer / Task Manager and see the name of the process and application causing the log entry.

BTW: it's not necessarily malware or a virus causing this. Might simply be a network scan request, that is denied by your computer's policy.

Possibly related: https://stackoverflow.com/questions/12140559/error-with-htaccess-and-mod-rewrite

Improve this answer
2
  • The pid in question (on my machine) is that of the Apache server itself, so I'll wager that's what it's referring to. What might be a good way to detect which process the network messages are coming from on the machine in question?
    – Luxart
    Dec 19, 2012 at 8:44
  • Ah yes, you're right of course; it's the Apache server itself. You could try out TcpView by the Microsoft-acquired SysInternals. It monitors all incoming and outcoming traffic over TCP/UDP, and might give you a hint where the messages originate from (application/user-wise).
    – pleinolijf
    Dec 19, 2012 at 9:54
2

Run a malware scanner such as Malwarebytes on the computer the requests are coming from.

Going along with the suggestion from pleinolijf, also run a virus scanner, such as Avast or AVG Free to ensure you cover all of your bases.

Improve this answer
4
  • 2
    Note that Malwarebytes is a malware scanner, and will not detect nor remove most viruses. Use a virus scanner for that (what's in a name eh?), like Avast!. Best is to scan using both a virus scanner and a malware scanner.
    – pleinolijf
    Dec 19, 2012 at 8:29
  • The computer in question has mcafee installed and scanning (includes a firewall and such), hasn't turned up anything yet...
    – Luxart
    Dec 19, 2012 at 8:32
  • 1
    @lexvegas You can edit your answer to include the mention of a Virus Scanner.
    – HaydnWVN
    Dec 19, 2012 at 8:55
  • Thanks, Still getting used to the the format of superuser.
    – Viertaxa
    Dec 19, 2012 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .