Hi, I'm using Logwatch 5.2.2 and in email today it emailed me the following: --------------------- httpd Begin ------------------------ A total of 4 sites probed the server 203.218.141.123 203.206.246.90 203.218.200.154 !!!! 3 possible successful probes /css/phpmyadmin.css.php?js_frame=left&num_dbs=0 HTTP Response 200 /css/phpmyadmin.css.php?lang=en-iso-8859-1&js_frame=right HTTP Response 200 /css/phpmyadmin.css.php?lang=en-iso-8859-1&js_frame=left&num_dbs=0 HTTP Response 200 ---------------------- httpd End ------------------------- What does this mean exactly? In my /var/log/httpd/access.log I see the following for 203.218.141.123: 203.218.141.123 - - [13/Aug/2004:21:43:40 +1000] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 which goes on for a couple of pages. I think the above is from a virus on their systems, but the probing stuff concerns me. I'm running phpMyAdmin 2.5.7-pl1, the latest stable. Thanks. Michael. Michael. Find local movie times and trailers on Yahoo! Movies. http://au.movies.yahoo.com
