There is a vulnerability in IIS that has been exploited lately by a worm, check out http://www.crn.com/Components/printArticle.asp?articleId=28301 for more details.

Lister...

>>I have a database site using westwind and it works GREAT.
>>
>>HOWEVER, yesterday someone has "hacked" into the site and every time I try to open ANY westwind page, it gives me a page saying the site has been hacked by the Chineese.
>>
>>All requests that go through WC.dll get that same page.
>>
>>The request does show up in westwind, and the PRG has NOT been changed, but te page returned is always the same.
>>
>>Somehow the WC.dll seems to have been changed, but it is NOT a new copy of the dll so it has NOT been changed.
>>
>>It is like IIS is sending the request to both wc.dll and something else.
>>
>>HELP!!!!!!!!!!!!!!!!!!!!
>>
>>I have turned the siote off, but will turn it back on if anyone wants to see what is going on.
>
>Check out the contents of INDEX.HTM/INDEX.HTML.
>
>It's possible that your "page" has been "defaced".