[nsp-sec] NSP-SEC-6364-ALERT compromised websites (torpig)

[Dirk Stander]

.: Jon Lewis (Mon, May 11, 2009 at 10:21:36AM -0400)
> entire web space until now and found one additional file with the malicious code.  The above 
> URL is in their password protected "members" area.  Do I want to know how it was discovered?

the script/FTP-client which injects the javascript runs recursively
through the file system and manipulates every `index' file
(index|main|default)\.(.html?|php\d*|asp)

We extracted this list from the HTTP-referers of a sinkhole.

    Kind regards, Dirk Stander (1&1) :.