March 15, 2005 - (HOSTSEARCH.COM) – The Internet Storm Center (ISC) reported yesterday that a number of web hosting companies that provide shared hosting had their servers exploited and all of their customer homepages modified so that visitors are attacked.
“In one case, a Perl script was used to modify each customers homepage with the additional IFRAME snippet that fellow handler Lorna had already reported in the diary two days ago. The Perl script reads in the web server configuration (httpd.conf) on a compromised server, and then appends the malicious iframe code to all the index.html pages of all the virtual hosts available on this server. The same reader who managed to isolate this script has also contributed a script written by himself to clean up the affected pages,” said Daniel Wesemann on the ISC site, “If successful, the exploits drop either of two files "mhh.exe" or "sr.exe", both of which so far are only recognized by Kaspersky and called (not-a-virus:AdWare.ToolBar.SearchIt.h). The files have been submitted to the other AV vendors.”
