[thelist] Probing for IIS? _vti_bin ?

[Joel Canfield]

> I'm getting a lot of 404 hits for people looking for
> /MSOffice or /_vti_*
>
> I assume this is a probe for some sort of IIS exploit?

Likely.

> webalizer has an index.html file in a _vti_cnf/ folder -- can
> I get rid of that safely?  (I'm not using FrontPage)

I nuke 'em all. I set my web servers up without FrontPage extensions, but
sometimes it seems like these little devils show up anyway. So I kill 'em
like vermin, and haven't seen any negative consequences, although I don't
have any solid proof that what I'm doing is safe or legal ;)

joel