Re: New web malwares attacking big hosting providers

[Davide Canali <davide () davidecanali com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I confirm this affects GoDaddy hosting too. Found a file called
ferdy_simonette.php in my web hosting root directory.

This file injects malicious code in all the .php and .html files in
your hosting directory and subdirectories (and maybe other file
extensions).

I'm going to analyze the "injector" code, as well as the one it
injects, in the next few hours.

So far, if you find any new file in your hosting directory, I just
recommend not to execute it. Or, if you dare,  make sure to
redirect your visitors somewhere else, or bring down your website
before you do.

Regards,

    Davide Canali
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkvjrHMACgkQ6yrfzQzWVMHIEgCfQcxDxG7mT8zU6o2KJys6n5iI
3pIAnjYqbcF9kHomL9I0hQSH2a1r8PCE
=5Cc3
-----END PGP SIGNATURE-----