Hi Nick, >It does this via the now very old ms-its: protocol zone-handling bug... >Apparently someone needs to decode a few more levels of JavaScript, etc >to work this all out...
I don�t think so. This looks a lot like the unpatched IE bug that was also exploited by the Ilookup trojan. See http://62.131.86.111/analysis.htm. >> Consider to deny access to http://217.107.218.147 in your firewall. This >> will at least prevent client PCs from getting infected. > >Thanks Peter, but what about all the _other_ servers out there also >hosting more or less exactly the same files? Are you going to provide >a list of all those IPs too? Why should I? I think you should look at the code again, Nick. When the javascript runs it will try to redirect you to a remote server http://217.107.218.147. This is where the MSITS.EXE and the javascripts are stored. As far as I know they do not reside on the compromised IIS servers, but simply pulls of the the payload from the remote host. Meanwhile the host is no longer available. Regards Peter Kruse _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
