Web servers still doling out "Scob" code

Hubbard declined to name the infected Web sites citing company policy, but said none were "high-profile" or popular enough to be listed among the 500 most-visited Web sites.

While the IIS 6 infections appear to be the result of upgrades to already-infected IIS servers, there are other ways that IIS 6 Web servers could be infected with Scob, according to a Microsoft spokeswoman.

Among other things, users with rights to publish to an IIS 6 server who also have rights on an infected IIS 5.0 server could transfer infected Web pages from one server to the other. Alternatively, IIS servers running Version 5 without the MS04-011 patch that upgraded to IIS Version 6 could also be vulnerable to attack, the spokeswoman said.

Microsoft is not aware of any direct infection of IIS 6.0 servers, she said.

Data from Websense supports that conclusion, as well. At least 20 of the 100 IIS 6.0 Scob sites Websense discovered were running IIS 5.0 until recently, and may have been upgraded manually by administrators unaware of the infection, or using Microsoft's AutoUpdate feature, he said.

Hubbard also points to the fact that the malicious code points to the original Russian attack sites as evidence that the infections are from the original attack in June.

"Why would someone design a new attack and still point to a Web site that's gone? It doesn't make sense for people to target computers in an attack if the payload is useless," he said.

In the meantime, Websense is attempting to contact the administrators of infected sites and encourage them to disinfect their servers, Hubbard said.

Hubbard has spoken to five different Webmasters of infected sites. Each had recently upgraded to IIS 6.0 for a variety of reasons and was "surprised" to hear that they had been infected with Scob, he wrote in an e-mail message.