We are investigating a case called "RFI - Russian IIS Hacks?" by Sans.org.
Some of the files at the hacked sites have been modified - a trojan downloader known as Scob has been appended to end of the files, causing Internet Explorer to execute it.
There are number of other files one of which is a new variant of Padodor.W.