> Is my webserver trying to make connections going out > on these ports, or is my webserver being attacked on these ports. >
Whether your web server is infected with the worm or not, I can't say for sure. But, according to the logs you've provided, it does appear to be your web server trying to connect to 65.56.237.226 on port 2002. Steve Bremer NEBCO, Inc
