Bad guy, very very bad guy

Hi all,

Every now and then, I get a visitor from this location:

http://my_ip_number/admin/business_inc/saveserver.php?thisdir=http://som...?

(I'm a bit hesitant to disclose the name of this some_dutch_site and some_dutch_person, because when I visit that site without the shell.txt in the url, I get some sort of very decent graphics artist, nothing suspicious. My hunch is that this guy doesn't even know his url is being misused by the character who put that shell.txt on his site. Could be wrong here, but that's my feeling).

The ip from which this visit originates, is different: the first time it came from Taiwan, then from France, and now it comes from Nebraska, from the "Phillips Manufacturing Company".

I have done some googling on "saveserver.php", and from what I understand, it tries to exploit an inclusion vulnerability in some server setup.

I also read the "shell.txt" from my visitor's url. My antivirus program protested, because it included some Backdoor (something) virus. I did manage to read the .txt file, however, and from glancing through it, I'd say it tries to collect a multitude of information from any site it gets access to.

Luckily, my Drupal guided this apparently unwanted visitor to an "Access Denied" page. Obviously, there is no admin/business_inc folder in my (or any Drupal) setup.

My question: I can't block this character on an IP-basis, because the IP number changes every time. There is, however, a consistency in the location (see top). Can I make some access rule or anything kicking this fellow to the moon, on the basis of the location string? E.g.: can I make something which keeps anything with "saveserver.php" in the url far away from my site?

I don't think there is any immediate danger, but I don't like this type of buggers. So, if anyone could help me getting visited by them, I'd be Very Thankful!