You Dream it...We Build it...
ColdFusion Muse
VB Script For Iframe Injection Attack
Thanks to Nate from CF-Talk I have a copy of the malicious VBS script that is doing the damage. If you are being victimized by this attack and you need to see the script for whatever purpose, let me know and I will make sure you get a copy. I now it goes without saying, but just don't run it :).
Meanwhile there is some consensus, given the root access of this code, that an infected server cannot be trusted even after a thorough cleaning. Dave Watts and Tom Chiverton both gave such advice. While it's not always possible and it's a huge hassle, it might be the best solution to bite the bullet and do it.
Blog provided and hosted by CF Webtools. Blog Sofware by Ray Camden.
I'm glad to say I haven't been bitten by this particular issue, since I'm not using VBS and on Linux, but I'm always curious about serious infections. Steve Gibson has said in the past that once a machine is infected with "sophisticated" code, since even a new harddrive does not save you if the bios is infected, that anything short of a new machine can never be 100% trusted.
What does everyone think of that?
You are correct... that's not very clear. I mean bite the bullet and completley start over - whether that means a new server or whatever. Bios infections are very rare - but what distingishes this infect from others is that it is not really pattern based and does not appear to be automated. Instead, it appears that the individual in question is "matching wits" with an actual hacker who has control of the machine. In that case (and given what the hacker has been able to accomplish is substantial) the user may well need to start with fresh hardware - or at least low level format the drives and flash the bios (which would turn the trick in 99.999 percent of cases).