[Xitami] access log

[Paul Reid]

> This access log looks like a collection of hack attempts.

Since you didn't post a snippet, we must guess what you are
seeing.

However, for the last few months, 95% of my errors.log and much
of my access.log is CodeRed, Nimba, or hack-scripts. 

> Alot of calls to WINNT directory. Funny I don't have WINNT

It is quicker for scripters to just try to access it than to
figure out what O/S you are on. That (invalid) URL will produce
no response or a 404 on most machines, but un-patched infected MS
IIS webserver will give a response (typically DIR). Hackers can
grep the script's output and quickly gleen a list of machines
worthy of further attention. 

 -PRR