canuckster

This exploit appears to have affected, among others, the UK's National Health Service, so it probably warrants attention.

PC World - Business Center: Major Sites Fall Victim to Web Hijack

James

Terra

If I read this correctly though it only affects .asp pages, so anybody on Linux with .php would not be hit?

Finjan MCRC Blog 2008 - Governmental, Healthcare, and Top Business Websites have fallen victims to the new round of Asprox mass attack

__________________
Underground, Overground, Wombling Free!

desquinn

While it does hit asp sites the technique could be used on any DB based site. Its a standard SQL injection and replaces images or image code.

For any windows server operators then have a look at URLscan version 3 as it can fend it off until you get the code fixed. Similarly htaccess should be able to deal with any attempts on php. Just look for CAST, DECLARE, EXEC etc.....