Hi Bryan, Put up the code and we'll post it on the site. :-) Tom -----Original Message----- From: Andrews, Bryan (COX-Atlanta) [mailto:Bryan.Andrews@xxxxxxx] Sent: Thursday, July 19, 2001 4:08 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Interesting Log entry http://www.ISAserver.org I trained my ISA to do it for me. :| -----Original Message----- From: Thomas W. Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx] Sent: Thursday, July 19, 2001 5:05 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Interesting Log entry http://www.ISAserver.org Hi Colin, But the good news is that all of us isaserver.org members always patch our web servers whenever a new fix comes out. Right? Right??? Tom www.isaserver.org/shinder -----Original Message----- From: Colin Wiseley [mailto:cwiseley@xxxxxxxxxx] Sent: Thursday, July 19, 2001 3:53 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Interesting Log entry http://www.ISAserver.org Here's an update to the story. It looks like whitehouse.gov and parts of the Internet could get hit pretty hard tonight. http://news.cnet.com/news/0-1003-200-6616583.html?tag=lthd Colin -----Original Message----- From: Thomas W. Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx] Sent: Thursday, July 19, 2001 4:14 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Interesting Log entry http://www.ISAserver.org That's it! I need to keep up on my reading :-) Spending too much time working! All the log entries have code 12202 which means the request was denied, so I'm safe. All the rest of you better check your published servers though! Thanks! Tom www.isaserver.org/shinder <http://www.isaserver.org/shinder> -----Original Message----- From: TRIEU, KENNY [mailto:KTRIEU@xxxxxxxxxxxxxxxx] Sent: Thursday, July 19, 2001 3:11 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Interesting Log entry http://www.ISAserver.org I think it's related to the IIS server attack that happen in the last few days. Check the following link for more information http://www.zdnet.com/zdnn/stories/news/0,4586,5094345,00.html -----Original Message----- From: Thomas W. Shinder [ mailto:tshinder@xxxxxxxxxxxxxxxxxx] Sent: Thursday, July 19, 2001 1:02 PM To: [ISAserver.org Discussion List] Subject: [isalist] Interesting Log entry http://www.ISAserver.org Anyone see a log entry like this recently in their web proxy log? 204.112.136.51, anonymous, -, N, 7/19/2001, 14:53:54, W3ReverseProxy, MIDAS, -, www.worm.[inserted so you don't hurt yourself]com, -, 0, 360, 4039, 0, -, TCP, GET, http://www.worm.com[inserted so you don't hurt yourself]/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3 %u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b %u53ff%u0078%u0000%u00=a, -, -, 12202, 0x0, Default rule, - -----Original Message----- From: Thomas W. Shinder Sent: Thursday, July 19, 2001 2:05 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: isalist http://www.ISAserver.org Hey Everyone, Stephen is the engine that makes the entire Isaserver.org organizaton run. He's the guy that does the stuff behind the scenes, and without his leadership, we all wouldn't have the great resources we have in www.isaserver.org! Three cheers for Stephen! HTH, :-) Tom www.isaserver.org/shinder Thomas W Shinder, M.D., MCSE, MCT -----Original Message----- From: David Dellanno [ mailto:david@xxxxxxxxxx] Sent: Thursday, July 19, 2001 1:39 PM To: [ISAserver.org Discussion List] Subject: [isalist] isalist -A Jedi's life (Network Admin's life) ...it will be a hard life..one without reward...without remorse....without regret. A path will be place before you... the choose is yours alone...do what your think you cannot do. It will be a hard life...but you will find out who... you really are..... "Qui-Gon Jinn" Keep up the good work Steve! David V. Dellanno msdemo.net (Cel.) 678.778.7220 (Res.) 770.736.8794 ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') To customise your settings for the list, kindly visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: ktrieu@xxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') To customise your settings for the list, kindly visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') To customise your settings for the list, kindly visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: cwiseley@xxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') To customise your settings for the list, kindly visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') To customise your settings for the list, kindly visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: bryan.andrews@xxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') To customise your settings for the list, kindly visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') To customise your settings for the list, kindly visit http://www.webelists.com/cgi/lyris.pl?enter=isalist