I downloaded a virus (OK, the EICAR pseudo "virus") and added alias statements to it so that the hackers would end up downloading an apparent "virus" and if *their* antivirus was doing its job they'd get virus alerts.
It probably achieves nothing, but it makes me happier. One side effect is that the error log stops growing, because those files are no longer "Not found".
these files are contents of the IIS, and can be hacked many ways.
That's why bad people try to "download" these to hack an IIS based web
server. As far as I know you can't do anything against it...