For those who haven't got it yet, it relies on a loophole in Internet Explorer 5.01 and 5.5. Microsoft have a patch to fix this - try

http://www.microsoft.com/technet/security/bulletin/MS01-020.asp

Kitty