Hi Michael. Incredible but it sounds spot on. I'm sure UT will take care of it though, whatever it is.



>Jos,
>
>I wonder if this could have anything to do with the recent problems on UT:
>
>http://isc.sans.org/
>http://isc.sans.org/diary.php?date=2004-06-24
>
>Excerpt:
>
>Compromised Web Sites Infect Web Surfers
>(for more details, also see yesterday's diary:
>http://isc.sans.org/diary.php?date=2004-06-24 )
>Updates will be posted here.
>
>A large number of web sites, some of them quite popular, were compromised
>earlier this week to distribute malicious code. The attacker uploaded a
>small file with javascript to infected web sites, and altered the web server
>configuration to append the script to all files served by the web server.
>The Storm Center and others are still investigating the method used to
>compromise the servers. Several server administrators reported that they
>were fully patched.
>
>If a user visited an infected site, the javascript delivered by the site
>would instruct the user's browser to download an executable from a Russian
>web site and install it. Different executables were observed. These trojan
>horse programs include keystroke loggers, proxy servers and other back doors
>providing full access to the infected system.
>
>The javascript uses a so far unpatched vulnerability in MSIE to download and
>execute the code. No warning will be displayed. The user does not have to
>click on any links. Just visiting an infected site will trigger the exploit.
>
>Mike
>
>>Hi Tom. The Wiki works fine for me. I think the answer might be that Symantec is getting a false positive with a recent definitiopns update. If no other av gets this problem then thats the most likely reason.
>>
>>Later
>>
>>
>>
<snip>