"Once a server is infected, the worm continues to scan for other vulnerable computers. In addition, the program takes control of the part of Microsoft's IIS software that delivers Web pages, allowing the virus to trump a request for any page--even invalid requests--and instead return a page infected with the virus."
http://news.cnet.com/news/0-1003-200...9.html?tag=nbs