MS05-001/002 - Webpages redirected to 7sir7 hacker site
The Internet Storm center reports that a highly automated home page hijacking attack is occurring on vulnerable servers and workstations using MS05-001 and MS05-002 exploits. A Google search this morning notes that the 7sir7 hacker site is shutdown but affected PCs would still attempt to go there. 
Entire web farms hacked to serve up the 7sir7 redirect http://isc.sans.org//diary.php?date=2005-03-13
http://www.google.com/search?&q=7sir7
quote:
We have received reports and evidence that a number of companies that provide shared hosting web servers have had their servers exploited and all of the customer homepages modified so that visitors are attacked. In one case, a Perl script was used to modify each customers homepage with the additional IFRAME snippet that fellow handler Lorna had already reported in the diary two days ago. The Perl script reads in the web server configuration (httpd.conf) on a compromised server, and then appends the malicious iframe code to all the index.html pages of all the virtual hosts available on this server. The same reader who managed to isolate this script has also contributed a script written by himself to clean up the affected pages. If you shout loud enough, we might include it in tomorrow's diary :-)
The page at 7sir7 is making use of several recent vulnerabilities in order to download and install malware on the PC of whoever visits the site.
- Exploits the .ANI cursor vulnerability (MS05-002)
- Exploits the HTML Help Cross Domain Vulnerability (MS05-001)
If successful, the exploits drop either of two files "mhh.exe" or "sr.exe", both of which so far are only recognized by Kaspersky and called (not-a-virus: AdWare.ToolBar.SearchIt.h). The files have been submitted to the other AV vendors