"Ject" Downloader Hits IIS Servers
Breaking News: "Ject" Downloader Exploits Unpatched Servers, IE
A downloader known as Ject has been isolated in the wild and is believed to currently be affecting IIS web servers and Windows 2000 servers that have not applied update 835732, which is fully addressed in Security Bulletin MS04-011, available here.
When an Internet Explorer user visits the compromised server, it will attempt to download a Trojan horse known as Downloader.Ject. Fortunately, at this time, the Russian site that houses Ject has been taken offline. However, follow-up attacks could and probably will occur on any system that is unpatched and administrators of vulnerable machines are urged to apply the 835732 update to avoid infection.
The Internet Storm Center reports that there are a number of indications that a web server is infected. This includes the presence of the files Kk32.dll and/or Surf.dat, all files being sent from the infected server including JavaScript - even text files like robot.txt, and the global footer of the machine being set to a new file.
Indications of possible infection from the user side includes a message about JavaScript on the active page (this may not display,) attempts to contact the server 217.107.218.147 (unassigned.m10-msk-ru.e-neverland.net) on port 80, and antivirus programs detecting one of a number of viruses. Ject has a number of names, including BackDoor-AXJ, JS.Scob.Trojan, Scob Trojan, JS.Toofer, and Downloader-Ject.
Systems running Windows XP SP2 or those with high security settings that disable features such as JavaScript are not affected. More information about this incident can be found here.