Re: Please tell me I'm wrong: microsoft.com infected

["Nick FitzGerald" <nick () virus-l demon co uk>]

Rodrigo Goya <lucent () securenet com mx> wrote:

> Confirmed
>
> I see it:
>
> window.open("readme.eml", null, "resizable=no,top=6000,left=6000")

Ditto, as have several others.

> Though it says "page not found".

Ditto.

I'd guess that the complex "physical" arrangement of such a large
site, and perhaps update mirroring lags, means that not all servers 
have received their "updates" including that file yet.  (Also, they 
may have AV software or other measures preventing the EML files from 
getting on the servers, but be worried about the overhead of having 
the on-access scanners parsing their HTML files each time they are 
served...


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com