"Microsoft" <lachev@comcast.net> wrote in message
news:OAG#dwHSDHA.2256@TK2MSFTNGP11.phx.gbl...
> Is there any way to prevent IIS 6 to log certain requests, such as the
worm
> virus attempts:
>
> 2003-07-06 04:36:28 W3SVC1 MILLENNIA 192.168.1.101 GET /scripts/root.exe
> /c+dir 80 - 66.56.41.105 HTTP/1.0 - - www 404 0 64 0 72 1361
> 2003-07-06 04:36:32 W3SVC1 MILLENNIA 192.168.1.101 GET /MSADC/root.exe
> /c+dir 80 - 66.56.41.105 HTTP/1.0 - - www 404 0 64 0 70 1622
>
> I understand that those are "not found" benign messages but they are
filling
> up my IIS logs and affecting the way the log analyzers interpret the
> results. I tried the UrlScan 2.5 but it doesn't prevent these messages to
be
> logged. Ideally, I would like these rejected before the request reaches
IIS.
>
>

"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:ugnVc5cSDHA.3636@tk2msftngp13.phx.gbl...
> I think the point is that we became spoiled with URLscan on IIS 5
> where these junk attempts would get filtered over to the URLscan
> log, keeping the IIS log more meaningful.
> AFAIK all that can be done is to post-process the IIS log to grep
> out the lines of interest.
>
> "Bernard" <qbernard@hotmail.com> wrote in message
> news:ODu5F8aSDHA.1252@TK2MSFTNGP10.phx.gbl...
> > Why so ? such information give you the info on any attacks.
> > and I don't think you can turn it off, unless you disable
> > entire logging in IIS.
> >
> > --
> > Regards,
> > Bernard Cheah
> > http://support.microsoft.com/
> > Please respond to newsgroups only ...
> >
> >
> > "Microsoft" <lachev@comcast.net> wrote in message
> > news:OAG#dwHSDHA.2256@TK2MSFTNGP11.phx.gbl...
> > > Is there any way to prevent IIS 6 to log certain requests, such as the
> > worm
> > > virus attempts:
> > >
> > > 2003-07-06 04:36:28 W3SVC1 MILLENNIA 192.168.1.101 GET
/scripts/root.exe
> > > /c+dir 80 - 66.56.41.105 HTTP/1.0 - - www 404 0 64 0 72 1361
> > > 2003-07-06 04:36:32 W3SVC1 MILLENNIA 192.168.1.101 GET /MSADC/root.exe
> > > /c+dir 80 - 66.56.41.105 HTTP/1.0 - - www 404 0 64 0 70 1622
> > >
> > > I understand that those are "not found" benign messages but they are
> > filling
> > > up my IIS logs and affecting the way the log analyzers interpret the
> > > results. I tried the UrlScan 2.5 but it doesn't prevent these messages
> to
> > be
> > > logged. Ideally, I would like these rejected before the request
reaches
> > IIS.
> > >
> > >
> >
> >
>
>