I have noticed a lot of entries in my Apache log that look like this:

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; CK={XlO79otDHX1EhYArH9tZspwMNd6b9BqPEzqpAwoCietDKokQxtOZRdyoPdlThqm+fGwpw/SmEZDKhk0TpLZ80idoKdZuuvnSMalIA/3VmVY=}; .NET CLR 1.1.4322; .NET CLR 2.0.50


Can anyone explain what the CK={...} part is? The actual value in the {...} part varies from browser to browser it seems. Is it an indication of a virus infected Internet Explorer, and if so should I be worried out these browsers connecting to the web server?

I have tried to find a reference to such strings with no luck so far.

That's the part of the user agent string where custom additions are to be found, like Yahoo! toolbars, Alexa, and so forth. My guess is that it is an improperly coded version of such an addition, perhaps spyware or similar. If so, it kind of sucks for the clients involved, but you have nothing to worry about as far as your web server is concerned as long as you are taking normal security precautions.