Re: [squid-users] Is it a virus or what ?

On Thu, Jul 01, 2004 at 09:49:21AM +0800, Abdur Rahmaan wrote:
> I have some clients which are TCP_DENIED to bizarres
> URLs. I've tried to identify thos URLs without any
> stisfying result. Could somebody tell me what it is ?
> Here are some lines in my access.log this morning:
>
> 1088687101.235 3 10.1.1.1 TCP_DENIED/407 1731 GET
> http://24.52.88.56:26076/2004/7/1/20/41/26/ - NONE/-
> text/html

The HTTP error code is 407 - which means "authentication required".
The user is just prompted for the username and password. If the user is
not prompted then probably some background process is trying to (ab)use
the proxy.

From my own experience the users has some kind of ad-ware on their
disks. Try running Ad-Aware if it's a (sigh) Windows box.

 Christoph

-- 
~
~
".signature" [Modified] 3 lines --100%--                3,41         All