URL is generated by the infected robot and the purpose is to exploit a vulnerability of the web server (In most cases, only IIS is vulnerable).
With such attacks, you will will always find a 'common string' in those URLs.
For example, with Code Red worm, there is always default.ida in the URL string. Some other worms send URLs with cmd.exe in it.<br>
-With 6.0 version and higher, you can set the <a href="awstats_config.html#LevelFor">LevelForFormDetection</a>
+With 6.0 version and higher, you can set the <a href="awstats_config.html#LevelFor">LevelForWormsDetection</a>
parameter to "2" and <a href="awstats_config.html#Show">ShowWormsStats</a> to "HBL" in
config file to enable the worm filtering nd reporting.<br>
However, this feature reduce seriously AWStats speed and the worms database (lib/worms.pm file) can't contain