Holy Shit!!! As I posted my last message to the list I was tweaking my Code Red page to also grep -c access_log for cmd.exe. The counter was at 507 when I wrote the script, two minutes later it was at 535. This thing is still in it's infancy too... prepare for DDoS's :-) Hmm.. got 15 while I was writing this. Keep in mind I'm on an @home network so these numbers could be inflated if it's similar to CR2. -Brian