We are investigating a case called "RFI - Russian IIS Hacks?" by Sans.org.

Some of the files at the hacked sites have been modified - a trojan downloader known as Scob has been appended to end of the files, causing Internet Explorer to execute it.

There are number of other files one of which is a new variant of Padodor.W.