> ..and yes, i realize no one here runs as 2.1.
I do. Unfortunately for you, I guess, only on Solaris.
However, I'd think you could capture such an HTTP request by putting up a
wrapper of some sort on a machine otherwise not running an HTTPD daemon.
Eventually the worm will hit it, or at least I suppose it will. Then you can
see what it looks like.
To fix your situation, though, without switching off W2K, because I sure
understand wanting to go with advanced software technology like that (ow, I bit
my tongue, that's what I get for leaving it in my cheek), I think you'll have
to use some kind of proxying setup; this could presumably reside all on the
same machine and use something like winet.
Just a thought. Hope it helps.
Michael