see http://www.microsoft.com/technet/security/topics/Nimda.asp
The MS01-020 patch mentioned in that article has now been superseded by the MS01-027 patch — http://www.microsoft.com/technet/security/…in/MS01-027.asp. The MS01-027 patch requires 5.01 SP2 – meaning SP2 does not contain the fix, as the article suggests.