Someone is running a scanner on your machine for known exploits.  
If you get a stealth scanner such as this one
http://www.nstalker.com/stealth.php

and run it against your site you will know then if you have problems or
not.  There are freeware scanners by the dozen so finding one shouldn't
be a problem.

Also get the Microsoft IIS Server hardening Guide and go through it.  It
does need to be done.  The Microsoft site has this guide.  

Looking at your log sample there doesn't seem to have been any success
with the scan.  The 3 digit number after the command information is the
return code.  See this site for there meanings
http://www.webopedia.com/quick_ref/error.html

There should be fuller information on other sites or your web server
help files for these return codes.

You can use www.samspade.org to find the culprit in question. If they
are not spoofing their address.  DO NOT try to connect to them direct
from your site, even with a ping.


Best of luck

Trevor Cushen

Reply via email to