Httpd access_log entry - have I been compromised?

Question

What's going on here? Has my security has been breached? Has someone caused a buffer overflow and then put something on my machine? If so, how could they access my machine?
My knowledge state: I do not have a in depth knowledge of security issues - only that they are important. Every once in a while I look at various logs and try to get an idea about what's happening on my machine.
My setup: macmini networked via airport to netgear wireless router connected via cable modem to Comcast.
Mini and firewall both password protected. Airport connection WEP protected.
OSX Firewall turned on - file sharing, personal file sharing, ichat and missing sync (PDA syncing software) only items enabled; router firewall on, connection restricted to the 3 devices on my LAN.
(If my setup worked as expected, I shouldn't see anything from 24.218.x.x on my system, it should have been stopped by my router...)
The following sequence shows up 3 times in a recent httpd access_log
24.218.83.129 - - [10/Oct/2006:18:50:16 -0400] "GET / HTTP/1.0" 200 5834
24.218.25.110 - - [10/Oct/2006:19:06:24 -0400] "GET / HTTP/1.0" 200 5834
24.218.25.110 - - [10/Oct/2006:19:06:24 -0400] "SEARCH /\x90\xc9\xc9\xc9\xc9\...(lots more \xc9)...\x90\x90\...(lots more \x90)...\x90\x90" 414 343
24.218.25.110 - - [10/Oct/2006:19:06:55 -0400] "POST /vti_bin/_vtiaut/fp30reg.dll HTTP/1.1" 404 307
24.218.83.129 - - [10/Oct/2006:22:43:11 -0400] "GET / HTTP/1.0" 200 5834
24.138.225.33 - - [10/Oct/2006:23:35:46 -0400] "GET / HTTP/1.0" 200 5834

Answer 1

OK well, if you don't need any access to Apache from outside then you should configure it to be inaccessible to the internet.
I use the built-in Terminal editor "pico" to edit the file, which is located at
/private/etc/httpd/httpd.conf.
First, make a backup of your httpd.conf file in case you break something while editing it.
Open httpd.conf and find the line that begins with Listen and then an IP address or hostname. Edit it to look like this:
Listen 127.0.0.1:80
If you find a second "Listen" line that designates port 80, leave it alone. It should already read:
Listen 80
The only "listen" lines in httpd.conf that are not commented out should be:
Listen 127.0.0.1
and
Listen 80
Then Apache will only accept connections from your local machine on port 80. Restart Apache to make your changes take effect. You can test to see if it worked by typing 127.0.0.1 into your web browser. If it worked you should see a default Apache page.
This is all off of the top of my head, but I think it should work. If it doesn't, just restore your original httpd.conf file from your backup and restart apache again and you'll be no worse off than you were before. 
If you want to be extra safe, you can also configure your firewall to block INBOUND connections on port 80. Make sure you don't block outbound port 80 or you won't be able to load any external webpages from that computer.
As for the attack deflection code, disregard it if you don't need it. Such hacks can cause mysterious problems in a development environment but work well on a normal server.