Friday, June 25, 2004
IIS Hacks? Posted by Katrin @ 00:56 GMT

We are investigating a case called "RFI - Russian IIS Hacks?" by Sans.org.

Some of the files at the hacked sites have been modified - a trojan downloader known as Scob has been appended to end of the files, causing Internet Explorer to execute it.

There are number of other files one of which is a new variant of Padodor.W.

<<< Yet another Korgo/Padobot worm variant found
Microsoft update on the Scob (aka Download.Ject) case >>>