Check on the IP though. Back when Code Red was running rampant I had attempts from 4 different IP's (I had the patch installed long before the outbreak). I traced those back and sent emails to the administrators at the ISPs involved and for the 3 that originated in the US, got the attacks stopped. The 4th was registered in Mexico and I don't speak or write Spanish.

Randy

>Oscar,
>
>You might want to goto this site and check for more info http://www.microsoft.com/security/
>
>Most of our servers here are seeing the same IIS log entries every few minutes. One of the other developers said though that he thinks the IP address in the request is spoofed so it's not displaying the real attacker.
>
>>After some research, I think it is some exploit of the WebDav vulnerability, but it seems widespread and I have not found any specific info. Before applying the MS WebDav patch, it crashed the server many times a day. After the patch, it does not crash anymore. But it must be a worm, I have been seeing it for some days now and do not know what it does.