<font face="Verdana, Arial, Helvetica, sans-serif" size="2">Originally posted by Kremmen:
I would have expected your site's firewall to be set up to discard virus scans, once identified, so that subsequent scans would never get near the web server.</font>
my bad, I used the wrong terminology... what it appears to be have doing was making simple http requests, which made it difficult to isolate from the "real" http requests we normally get. The virus was looking for particular files native to Microsoft servers, by making requests for these. Since we don't have that type of server environment, all it was getting was 404 pages, but a lot of those...