<div>
Hi,<br />
<br />
it is caused by attempts to exploit a known IIS security vulnerability:<br />
<br />
<a href="http://www.securityspace.com/smysecure/catid.html?id=10357" rel="ugc">http://www.securityspace.com/smysecure/catid.html?id=10357</a><br />
<br />
If your patches and security updates are all in order then you ought to be safe from any damage. &nbsp;There is not much that you can do to stop these coming in other than trapping every request at the firewall and blockingthose ip addresses for 'x' minutes/hours.<br />
<br />
The requests are probably coming from systems infected by some worm attemtping to replicate to other unpatched systems.<br />
<br />
Cheers.<br />

</div>


<div>
Is there a way to determine if the reference is a valid use of the DLL or if it is trying to do something malicious?
</div>


<div>
what is the result of these requests? &nbsp;is it 200 or 404 or something else?<br />
<br />
Cheers.<br />

</div>


<div>
All the ones I've looked at have a 200.
</div>


<div>
<div class="content wysiwyg-content">
We have an internal web server running IIS and in the last month there were more than 6.5 million requests to /msadc/msadcs.dll.<br />
<br />
Is this normal?<br />
<br />
How can I determine what is making the calls?<br />

</div>
</div>


We have an internal web server running IIS and in the last month there were more than 6.5 million requests to /msadc/msadcs.dll.

Is this normal?

How can I determine what is making the calls?


Hi,

it is caused by attempts to exploit a known IIS security vulnerability:

http://www.securityspace.com/smysecure/catid.html?id=10357

If your patches and security updates are all in order then you ought to be safe from any damage.  There is not much that you can do to stop these coming in other than trapping every request at the firewall and blockingthose ip addresses for &amp;#39;x&amp;#39; minutes/hours.

The requests are probably coming from systems infected by some worm attemtping to replicate to other unpatched systems.

Cheers.


Is there a way to determine if the reference is a valid use of the DLL or if it is trying to do something malicious?

what is the result of these requests?  is it 200 or 404 or something else?

Cheers.


All the ones I&amp;#39;ve looked at have a 200.

What is /msadc/msadcs.dll used for?

IIS is Internet Information Services, the web server included with Windows Server operating systems. All current versions are built on a modular architecture; modules can be added or removed individually so that those required for specific functionality are installed. The full installation of IIS includes HTTP, security, content, compression, caching, logging and diagnostics.