"Peter Kruse" skrev
> Ser andre hvad jeg ser, eller skal jeg tørre mine øjne en ekstra
> gang ??:
www.microsoft.com/frontpage window.open("readme.eml"
Jeg har netop modtaget denne email fra Scott Culp på en mailingliste
(win2ksecadvice@LISTSERV.NTSECURITY.NET):
"Hi All -
This is incorrect. The Microsoft FrontPage site is not infected. =20
By way of background, keep in mind that when the Nimda worm infects a
web server, it modifies data on the server in order to pass the
infection to any users who browse to the site. Specifically, it
creates a payload file called readme.eml on the server, then modifies
the web pages on the site to launch the file using the vulnerability
discussed in Microsoft Security Bulletin MS01-020
(
http://www.microsoft.com/technet/security/bulletin/MS01-020.asp).
In the case of the FrontPage site, an HTML file from a third party
vendor's infected system was propagated to the site -- but the server
on the FrontPage site had never been infected, so the payload file
wasn't present on the machine. That is, the web page contained a
reference to a non-existent file.. However, many virus scanners scan
HTML pages and flag any that refer to readme.eml as being infected.=20
That's what happened in this case.
We've removed the web page, and are working with the vendor to ensure
that their systems are worm-free. Sorry for any inconvenience.=20
Regards,
Scott Culp
Microsoft Security Response Center
Microsoft Corporation"
Emailen var PGPet, så jeg regner med at det er ham selv der sendt den.
Med venlig hilsen
Peder