[ale] File does not exist: _vti_bin | MSOffice

Robert Coggins ale at cogginsnet.com
Wed Nov 19 22:15:51 EST 2008


I believe _vti_bin is a frontpage extension.  Most likely it is someone
trying to exploit your server hoping for an unpatched MS box.  Could be
an honest mistake of someone connecting to your servers with frontpage,
however I doubt it.

Rob

Jim Popovitch wrote:
> I can't find a definitive explanation... so I am seeking input here.
> If one sees a web server request for  /_vti_bin  or /MSOffice, is that
> normal behavior of IE clients or is it indicative of malicious
> activity?
> 
> Thx,
> 
> -Jim P.
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale


More information about the Ale mailing list