Anne Wilson wrote: > On Wednesday 03 June 2009 06:09:37 John R. Dennison wrote: >> He's running an apache instance on cent5. He has processes he >> can not readily identify running under apache named "atack"; >> where does "windows" come into the equation? > > Several of the links returned by google have the following info: > > IIS WebDAV Exploit, I think one of the agobot worms tries to use it to get > into Windows boxes. well when I google I have to conclude that this all has to do with helicopters.