The main site which is hosting the malicious code right now is “ads-t.ru”. Sites which have been hacked by this attack tool will contain a tag which leads to the page “ads-t.ru/ads.js”. A quick Google search for this string will currently reveal more thousands of webpages which have had this code injected.

The Javascript causes an IFRAME to be loaded which causes the following file to be loaded:
adtcp.ru/ad/index.php

That domain was registered on September 29th with the email address omit@blogbuddy.ru

I wasn’t sure if I should try my malware analysis VM 30,000 feet over Wichita Kansas, but I gave it a shot. The index.php file downloads a hostile Flash Player file:

/ad/spl/files/8628468724.swf

That file is only 797 bytes. VirusTotal has 1 of 41 detects for it, with Symantec calling it “Bloodhound.Exploit.266″. The MD5 is 148a8c05fb0b63f036f024e2104a6e4c

The index.php files also causes a malicious PDF file to be downloaded. When the PDF file is opened by an older version of Adobe Reader, the computer becomes infected with one of the “scareware” fake Anti-virus products.

The domain names involved in this scam are all Fast Flux hosted, meaning that machines belonging to a botnet are used to resolve the website addresses. The traffic is then proxied from those IP addresses to the “real” criminal server.

C:\Documents and Settings\[MyNAME]\Local Settings\Temp\VWDWebCache\ftp_[domainname]_[rootdir]\

It also gets the entire cache at various other times. This can be painful for a large directory.

There are certainly no options for it in the property page for the FTP site in Solution Explorer.

Note that you can at least “press ESC to cancel”, to stop it downloading.

Note as well that when you edit a file, it’s pulled into that same cache, and if you do a “file>save as”, you’ll see that the file you’re editing is really now a local copy. That makes sense, of course, in that you could lose the connection to the remote server. At least you’d still have the local copy. When you do a save, the cache folder version of the file is actually pushed up to the FTP site.

1. Click Start, point to Settings, and then click Control Panel.
2. In Control Panel, double-click Add/Remove Programs.
3. Click Add/Remove Windows Components.
4. In the Windows Components Wizard, click Internet Information Services (IIS), and then click Details.
5. Click to select the following check boxes:
Common Files
Documentation
Internet Information Services Snap-In
Internet Services Manager (HTML)
NNTP Service
World Wide Web Server
6. Click OK, and then on the Windows Components page, click Next.
7. On the Completing the Windows Components Wizard page, click Finish.
8. In the Add/Remove Programs dialog box, click Close.

IIS and the NNTP service are now installed.

Back to the top
Configure the NNTP Virtual Server
The NNTP virtual server that is created when you install Microsoft NNTP Service is automatically configured with default settings that enable it to accept local client connections. You can either accept the default settings or change the NNTP virtual server configuration. There are many options available for you to configure the NNTP virtual server to meet your needs.

This section explains how to configure the following three (required) options:

* Assign an Internet Protocol (IP) address
* Set the Authentication method
* Configure the Virtual Directory settings

Assign an IP Address
To assign an IP address to your NNTP virtual server, follow these steps:

1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager. Or, open the Microsoft Management Console (MMC) that contains the IIS snap-in.
2. In the console tree, right-click Default NNTP Virtual Server, and then click Properties.
3. In the Default NNTP Virtual Server Properties dialog box, click the General tab.
* If you want the NNTP virtual server to respond to connection requests for all IP addresses configured on the computer, click (All Unassigned).

This is the default setting.
* If you want to assign a specific IP address to the NNTP virtual server, click the IP address that you want to assign in the IP address box.
* If you want to assign additional IP addresses to the virtual server, click Advanced, and then click Add. In the Identification dialog box, specify the IP address and Transmission Control Protocol (TCP) and Secure Sockets Layer (SSL) port numbers. Note that the default TCP port is 119, and the default SSL port is 563. Click OK twice to return to the Default NNTP Virtual Server Properties dialog box.
4. Click OK to return to the Internet Information Services window.

The NNTP virtual server is now configured to accept connection requests from the IP address assigned to it.

Set the Authentication Method
To specify the authentication methods that you want to set on the NNTP virtual server, follow these steps:

1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager. Or, open the MMC containing the IIS snap-in.
2. In the console tree, right-click Default NNTP Virtual Server, and then click Properties.
3. In the Default NNTP Virtual Server Properties dialog box, click the Access tab.
4. Under Access control, click Authentication.
5. Specify the authentication method (or methods) that you want.

Click to select one or more of the following check boxes, and then click OK:
Allow anonymous
Basic authentication
Windows security package
Internet Services Manager
Enable SSL client authentication
NOTE: If you do not want to restrict access to a newsgroup, click to select the Allow anonymous check box to enable anonymous access. In addition, do not set any Windows 2000 Server folder permissions for the folder that contains the newsgroup.

6. Click OK twice to return to the Internet Information Services window.

The authentication method (or methods) that you specified are now configured for the NNTP virtual server.

Configure the Virtual Directory Settings
A virtual directory is a folder on a local or remote drive that stores newsgroup content. Each virtual directory represents a level of your newsgroup hierarchy. You can create as many virtual directories as needed to match the structure of your newsgroup hierarchy.

When an NNTP Virtual Server is created, two virtual directories, Control and Default, are created by default. The Control virtual directory stores all control processing content, and the Default directory stores newsgroup and article content.

To configure the virtual directory settings, follow these steps:

1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager. Or, open the custom MMC containing the IIS snap-in.
2. In the console tree, double-click Default NNTP Virtual Server to expand the container.
3. Click Virtual Directories.
4. In the Newsgroup Subtree pane, right-click the directory that you want (for example, Default), and then click Properties.
5. Under Virtual Directory Properties, click Contents. In the Directory Contents dialog box, specify the storage location that you want for the virtual directory’s contents, and then click OK.

The default location for the home directory is Inetpub\Nntpfile\root. NOTE:

* If you want to allow news clients to post articles to newsgroups in this directory, click to select the Allow posting check box under Access restrictions.
* To generate an access log for this directory in the IIS access log, click to select the Log access check box under Content control.

NOTE: To turn on logging, you must also click to select the Enable logging check box on the General tab of the NNTP virtual server Properties dialog box. (In the console tree, right-click your virtual server, click Properties, and then click the General tab).
* To index the contents of the directory by using Microsoft Indexing Service, click to select the Index news content check box. By doing this, users can query the newsgroup articles for specific words or phrases.
6. Click OK to return to the Internet Information Services window.

The NNTP virtual server is now configured with the settings that you specified, and is ready to accept incoming requests from NNTP clients. After you define the newsgroup hierarchy structure and then create newsgroups, users can post articles to, and view the articles in, those newsgroups.

1. In IIS Manager, right-click the local computer, and then click Properties.
2. Select the Enable Direct Metabase Edit check box.

cscript C:\inetpub\adminscripts\adsutil.vbs set w3svc/ASPMaxRequestEntityAllowed 10484880

Finding the ASPMaxRequestEntityAllowed node, and changing the value.

With Windows Vista and Windows Server 2008, the way to set this changed again! To achieve the same setting, it can now be done via the IIS Administrative tool. To change do the following:

• Open IIS Manager from the Administrative Tools
• Select the Server from the tree structure on the left hand side
• Double click on ASP in the right pane.
• You will see a list of properties, Expand the Limits Properties and you will see Maximum Request Entity Body Limit. Set the value here in bytes to the upload limit you wish to set. Click Apply.

There is a similar limit imposed in all flavours of ASP.net. This can be configured in the machine.config file of the machine or in the web.config for the application. Adding the following under the <system.web> tag in the will increase the ASP.net maximum upload to 10Mb in this example.

<system.web>
      <httpRuntime maxRequestLength="102400" />
</system.web>

As you can see, it isn’t too difficult to resolve this issue, although the way to change the setting can be difficult at first to find.
I hope this guide makes it a little easier for you.