http://www.theregister.co.uk/2008/01...web_infection/
http://www.finjan.com/Pressrelease.a...Lan=1819&lan=3
Having had that thing infect my web server (we had an OSreload done so its not there now) I can say it is a real nasty piece of work, whoever created that thing needs to be locked up for a very long time.
The worrying thing is It can seemingly slip in undetected for the most part and due to the fact it only seems to inject into the site code the first time someone new visits if your not aware of it you probably wouldn't even notice its there for a long time particularly if you happened to have a lot of tabs/sites open at the same time and as it injects the code dynamially as the page is called by apache using randomly generated script it is a Real problem trying to find the cause.
Worth watching out for if your a server admin, but equally worth watching out for if your just someone browsing the web.
Will try to either load an activex (remote data services or some such), a JS expoit or a quicktime exploit among others.
Join CF
You are here: 
