In special cases, charges that are normally incurred for support calls may be canceled, if a Microsoft Support Professional determines that a specific update will resolve your problem. Normal support costs will apply to additional support questions and issues that do not qualify for the specific update in question. This fix corrects the vulnerability by restricting Showcode.asp, Code.asp, and CodeBrws.asp to viewing only files in the current directory. However, Web site operators who do not have a need to provide the file viewing capability may choose to remove all copies OF Showcode.asp, Code.asp, and CodeBrws.asp from the server altogether. Sensitive data exists on the same logical drive as Showcode.asp, Code.asp, and CodeBrws.asp.
Malicious users know the path and file name of files that contain sensitive data.
The default installation directories listed below the fix installation package will attempt to locate the files as they were installed onto the effected system. After you install the fix, you should perform a complete disk search for these files to verify that all instances of these files have been replaced. If your IIS 4.0 installation was installed into a different directory than the default directory, then you must verify that the effected files have been removed and replaced by performing a full disk search for these files. Therefore, if you to choose to remove it, perform a full-disk search to locate all copies. Open a command prompt and change to that directory.