I only see these types of queries come from certain IP addresses and I really don't think their done on a legit basis.  For example.  The IDS system monitored 3,500 requests and this request never once came up.  I also had the training database analyze my IP addresses activity for days and never once did I nor any of the 20 other people who access the site from my IP address ever trigger this alert.  Every day or two I see a request like this appear, however, it comes from remote IP sources.  I can't generate this request myself...  Also, if a local module of my site generated this request wouldn't the source IP be the same as my web server?

What resource is delivered when you convert the mal-formed querystring into a valid one (by changing the semicolon to a question mark)?  Is it possible that some third party has an improperly formed link pointing to this resource?  Do the requests contain a referrer?

Brandon