Microsoft has posted and revised a security update, What You Should Know About Download.Ject, that makes the recent furore about Internet Explorer (below) sound a little overblown. It turns out that the vulnerability to Web servers had already been fixed by patch 835732 in Microsoft Security Bulletin MS04-011. Most rational companies would already have installed this to block the Sasser worm. People running AutoUpdate in April would have got the patch.
Home users can find out if their systems have been compromised by searching for the files Kk32.dll and Surf.dat
The Russian Web site distributing the code was closed down on Friday so this particular exploit is no longer a threat. However, Microsoft recommends that home users increase IE's security setting to High. This will stop some sites from working. However, if you trust these sites, you can add them to the Trusted zone and retain the High setting for general use.
XP users who have installed the SP2 Service Pack beta are not affected, which makes the delays to SP2 even more regrettable....
