--- httpd.conf.orig	Wed Sep 19 15:41:58 2001
+++ httpd.conf	Wed Sep 19 15:41:39 2001
@@ -597,7 +597,12 @@
 # If you prefer a single logfile with access, agent, and referer information
 # (Combined Logfile Format) you can use the following directive.
 #
-CustomLog /var/log/httpd-access.log combined
+SetEnvIf  Request_URI "default\.ida" wormlog
+SetEnvIf  Request_URI "cmd\.exe"     wormlog
+SetEnvIf  Request_URI "root\.exe"    wormlog
+SetEnvIf  Request_URI "Admin\.dll"   wormlog
+CustomLog /var/log/httpd-worm.log combined env=wormlog
+CustomLog /var/log/httpd-access.log combined env=!wormlog
 
 #
 # Optionally add a line containing the server version and virtual host