It doesn't happen with the same frequency as the typical worm hits. I can't think of a good way to correlate it to a hit. Ideas? tcpdump port 80 to a file, and you should be able to time correlate to the sessions error log entry. John