Thanks, David.
After some research, I think it is some exploit of the WebDav vulnerability, but it seems widespread and I have not found any specific info. Before applying the MS WebDav patch, it crashed the server many times a day. After the patch, it does not crash anymore. But it must be a worm, I have been seeing it for some days now and do not know what it does.