[iks]

[clutch]

Looks like a Code-Red style attack. If you install IISLockdown (or at least URLScan) from MS that will harden IIS to that type of attack and reject those URLs.

IISLockdown
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/tools/locktool.asp

URLScan (my fav)
http://support.microsoft.com/default.aspx?scid=KB;EN-US;q307608&id=307608&sd=tech

[iks]

Hi!

Thanks for this... Ill sleep much better now ...

[Butternuts]

The Fact your giving out 404 errors shows that it is not finding what it wants. If those were not there. . . . .worry.

[iks]

Hi!

Yeah IIS was giving out 404, that's good but some of them were 500 (Internal Server Error) and so on...

Okay now I've got one more question:
When I try to telnet to my XP box via port 17 I get this strange qotations... They are making me a little worried:

Code:

iks@iksbox2&#58;~$ telnet <my_domain> 17
Trying <my_IP>...
Connected to <my_domain>.
Escape character is '^&#93;'.
"We have no more right to consume happiness without producing it than to
 consume wealth without producing it." George Bernard Shaw &#40;1856-1950&#41;
Connection closed by foreign host.

iks@iksbox2&#58;~$ telnet <my_domain> 17
Trying <my_IP>...
Connected to <my_domain>.
Escape character is '^&#93;'.
"The secret of being miserable is to have leisure to bother about whether
 you are happy or not.  The cure for it is occupation."
 George Bernard Shaw &#40;1856-1950&#41;
Connection closed by foreign host.

iks@iksbox2&#58;~$ telnet <my_domain> 17
Trying <my_IP>...
Connected to <my_domain>.
Escape character is '^&#93;'.
"When a stupid man is doing something he is ashamed of, he always declares
 that it is his duty." George Bernard Shaw &#40;1856-1950&#41;
Connection closed by foreign host.

iks@iksbox2&#58;~$ telnet <my_domain> 17
Trying <my_IP>...
Connected to <my_domain>.
Escape character is '^&#93;'.
"Man can climb to the highest summits, but he cannot dwell there long."
 George Bernard Shaw &#40;1856-1950&#41;
Connection closed by foreign host.

Okay what is this? Some of my friends are having the same 'problem' but not my brother (he is not running IIS). On port 17 I see TCPSVCS.EXE application.

Thanks for everything,

[clutch]

Judging by the quotes and the port, I would say that's going to be the Quote of the Day Protocol (QOTD) at work. Just block that (and any other) unused port. Here is a list of ports and what they are (normally) used for:

http://www.iana.org/assignments/port-numbers