I get the EXACT stuff on my server. They show up in my Access and Error log. The server seems 100 % intact. The box is also running mySQL I've bastioned NT 4 WKS on SP6. Can't find any trace of a successful hack. Anyone with a clear answer on what this is ... ? I too suspect an attack. Best Regards, Gunnar Swan Find the best deals on the web at AltaVista Shopping! http://www.shopping.altavista.com