live stats

need help decoding this...

[macrost]

Hello all! I just checked my live stats and found this...
Session Details
IP Address 68.*.*.247
Reverse DNS Morristown-68-*-*-247.chartertn.net
From / Via n/a
Origin Location Not Available
Time Spent 0 min
Hits / Kilobytes 7 / 17.17Kb
Browser Tag MSFrontPage/5.0
Referring URL

Date and Time URL
2003-05-07 13:43:41 - user created
2003-05-07 13:43:41 /
2003-05-07 13:43:41 /_vti_inf.html
2003-05-07 13:43:41 /_vti_bin/shtml.dll
2003-05-07 13:43:41 /_vti_bin/_vti_aut/author.dll
2003-05-07 13:43:58 /_vti_bin/_vti_aut/author.dll
2003-05-07 13:44:18 /_vti_bin/_vti_aut/author.dll
2003-05-07 13:44:37 /_vti_bin/_vti_aut/author.dll
I replaced the middle two ip's with asterisks. If anyone has a thought, please let me know! My site is running on win 2k server.

[sullen]

Looks very much like a would-be hacker trying to get to your site via a frontpage loophole.

Did all this vti_bin hits return a 404 error?

If so you have nothing to worry about. If not, you'd better make sure that your Server is patched up to date (perhaps even turning off the Frontpage extensions in the meantime).

On the other hand, if you haven't noticed any evidence of an attack on your site you probably have nothing to worry about. Best check everything though (some nice person used this method to put a very explicit photo on my site a few months ago - it does happen).

[macrost]

Thanks Sullen!
I have notified my host of this and hope that nothing happened.
Mac

[Xoc]

Those files are part of the FrontPage server extensions. You will see those hits in the log when someone tries to upload pages to your server.