On Wed, 2008-02-06 at 01:54 -0500, Michael Sammartano wrote: > Craig, > > 1. missing info, include a few complete lines. > 2. May be an attacker trying to edit your site with Front Page, if front page extensions are enabled, > 3. If this is a windows server, the box may hev been compromised. > 4. If needed contact me off list. > > Mike > ---- Craig White wrote: > > from web logs...what is this as a user agent? > > > > Microsoft Data Access Internet Publishing Provider Protocol Discovery > > > > ? > > ---- No - it's an apache server (Linux) access_log looks like IP_ADDRESS - - [05/Feb/2008:17:55:56 -0700] "OPTIONS /mccain.jpg HTTP/1.1" 200 - "-" "Microsoft Data Access Internet Publishing Provider Protocol Discovery" IP_ADDRESS - - [05/Feb/2008:17:55:57 -0700] "GET /mccain.jpg HTTP/1.1" 200 56535 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11" This was the same ip address - just one second apart. I've never seen that before. Craig --------------------------------------------------- PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us To subscribe, unsubscribe, or to change your mail settings: http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss