Thread: Apache2 has a proxy emdeded !?!?
View Single Post

  #1 (permalink)  
Old 05-19-2008, 06:02 PM
permalac permalac is offline
Junior Member
User
  
Join Date: May 2008
My distro: fedora
Posts: 17
Rep Power: 0
permalac is on a distinguished road
Default [solved]Apache2 has a proxy emdeded !?!? [Mod_proxy]
This is the problem:


if i start apache2 (/etc/init.d/apache2 start ) my computer goes slower.

I've checked all the logs, and ps and this stuff : conclusion :

somehow i have a proxy on the apache2 that each time I start an apache2 it starts a bunch of `httpd -k start`

Then on my /var/log/apache2/access.log apears like this :

Quote:
61.139.105.166 - - [19/May/2008:14:16:14 +0200] "GET http://ad.yieldmanager.com/iframe3?A...t%2findex.html HTTP/1.1" 302 - "http%3A%2F%2Fwww.btflash.net%2Findex.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 2.0.40"
61.139.105.166 - - [19/May/2008:14:16:14 +0200] "GET Vueling - Vuelos baratos, ofertas de hoteles, alquiler de coches HTTP/1.1" 20027062 "http%3A%2F%2Fwww.abcflashgames.com%2Findex.ht ml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.43"
61.139.105.166 - - [19/May/2008:14:16:15 +0200] "GET clickair[[XXX]] HTTP/1.1" 302 - "http%3A%2F%2Fwww.btflash.net%2Findex.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 2.0.40"
61.139.105.166 - - [19/May/2008:14:16:16 +0200] "GET clickair HTTP/1.1" 200 833 "http%3A%2F%2Fwww.btflash.net%2Findex.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 2.0.40"
61.139.105.166 - - [19/May/2008:14:16:17 +0200] "GET http://ad.yieldmanager.com/iframe3?A...m%2findex.html HTTP/1.1" 302 - "http%3A%2F%2Fwww.qooxo.com%2Findex.html" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
61.139.105.166 - - [19/May/2008:14:16:18 +0200] "GET clickair[[XXX]] HTTP/1.1" 302 - "http%3A%2F%2Fwww.qooxo.com%2Findex.html" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
75.125.215.50 - - [19/May/2008:14:16:03 +0200] "POST Especial Elecciones Municipales 2007 HTTP/1.1" 200 20551 "http://www.elecciones.granadahoy.com/foros/posting.php?mode=newtopic&f=1&sid=8d9dad92115df71a c105a4bdf0037b7b" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
marcos@pcmdevera:~$ tail -f /var/log/apache2/access.log
75.125.215.50 - - [19/May/2008:14:16:03 +0200] "POST P-Winner HTTP/1.1" 200 58017 "http://p-win.jp/pc/bbs/apeboard_plus.cgi?adcode" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
61.139.105.166 - - [19/May/2008:14:16:13 +0200] "GET http://ad.yieldmanager.com/iframe3?A...m%2findex.html HTTP/1.1" 302 - "http%3A%2F%2Fwww.abcflashgames.com%2Findex.ht ml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.43"
61.139.105.166 - - [19/May/2008:14:16:14 +0200] "GET Vueling - Vuelos baratos, ofertas de hoteles, alquiler de coches HTTP/1.1" 302 - "http%3A%2F%2Fwww.abcflashgames.com%2Findex.ht ml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.43"
61.139.105.166 - - [19/May/2008:14:16:14 +0200] "GET http://ad.yieldmanager.com/iframe3?A...t%2findex.html HTTP/1.1" 302 - "http%3A%2F%2Fwww.btflash.net%2Findex.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 2.0.40"
61.139.105.166 - - [19/May/2008:14:16:14 +0200] "GET Vueling - Vuelos baratos, ofertas de hoteles, alquiler de coches HTTP/1.1" 20027062 "http%3A%2F%2Fwww.abcflashgames.com%2Findex.ht ml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.43"
61.139.105.166 - - [19/May/2008:14:16:15 +0200] "GET clickair[[XXX]] HTTP/1.1" 302 - "http%3A%2F%2Fwww.btflash.net%2Findex.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 2.0.40"
61.139.105.166 - - [19/May/2008:14:16:16 +0200] "GET clickair HTTP/1.1" 200 833 "http%3A%2F%2Fwww.btflash.net%2Findex.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 2.0.40"
61.139.105.166 - - [19/May/2008:14:16:17 +0200] "GET http://ad.yieldmanager.com/iframe3?A...m%2findex.html HTTP/1.1" 302 - "http%3A%2F%2Fwww.qooxo.com%2Findex.html" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
61.139.105.166 - - [19/May/2008:14:16:18 +0200] "GET clickair[[XXX]] HTTP/1.1" 302 - "http%3A%2F%2Fwww.qooxo.com%2Findex.html" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
75.125.215.50 - - [19/May/2008:14:16:03 +0200] "POST Especial Elecciones Municipales 2007 HTTP/1.1" 200 20551 "http://www.elecciones.granadahoy.com/foros/posting.php?mode=newtopic&f=1&sid=8d9dad92115df71a c105a4bdf0037b7b" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"


and more , and more.
..........
i've installed, updated and ran rkhunter and i've got nothing. Any ideas?

thanks for reading.
Last edited by permalac; 05-21-2008 at 08:20 PM.
Reply With Quote