possible IIS exploit on Linux

does sasser do that?

Not to my knowledge. sasser would drop invisible exe in root of xp & w2k.

Naw, now Sasser. It doesn't do any port 80 connections.
I looked through my web server logs for the past 3 days, and nothing in there like this.
Do you have the SEARCH verb enabled, or turned off?

Do you have the SEARCH verb enabled, or turned off?

How, where do I do this?

it does look like a DoS attack...

look in ur logs.....

see who had telneted on ur box..do u have any user which was not created by u.....chk ur network traffic see if its same or increased

Regards,
Peeyush Maurya
http://www.peeyush.tk/