Sam Varghese wrote: > Looking at my logs, it seems to work: > > GET /cmd.dll HTTP/1.0" 302 > > GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 302 > > Same Apache redirect response as for /default.ida > and that, I know, works. Depends what you mean by "works". Apache is sending the redirect message that you want it to send. The virus is probably ignoring it, though. Craig