Windows users have been warned to avoid using Internet Express until a serious hole in the browser's security is fixed.

The problem is been caused by Russian hackers, who have placed code on popular Web sites that allows them gain control of PCs. The attack – known as the Scob outbreak – is considered more dangerous that the Sasser and Blaster incidents.

Microsoft is telling systems administrators to make sure they have installed a previously announced patch to guard against the security problems currently affecting Web sites using the company's Internet Information Services (IIS) 5.0 server.

The company said: "Users who have already deployed Windows XP Service Pack 2 RC2 appear to be protected."

Program manager at Microsoft's security response center Stephen Toulouse told Computerworld: said: "All early indications point to IIS 5.0 servers being affected. Evidence so far suggests that the attackers are breaking into IIS servers via a previously disclosed buffer-overrun problem in the Private Communications Transport protocol, which is part of the Microsoft Secure Sockets Layer library."

"That problem was addressed with the MS04-011 patch, which is why Microsoft recommends that users install it," he added.

However, a third flaw has been discovered and Microsoft is yet to issue a patch that deals with this.

Toulouse continued: "Desktop systems can be infected via two vulnerabilities in Internet Explorer, one of which has an available patch and one that doesn't. Microsoft is working on a patch for the problem. But users who keep their systems updated with the latest antivirus patches or have the high-security setting turned on while browsing the Internet should be reasonably protected."

Warnings issued

Analyst at TruSecure Corp Russ Cooper said: "It would be smart for administrators running IIS 5.0 to ensure there is no unusual JavaScript code appended to the bottom of the Web pages served up by their sites. Check to see if you have document footers enabled when they are not supposed to be."

According to an advisory by Computer Associates: "A Trojan horse program named JS. Toofer or JS. Scrob is installed on vulnerable IIS servers. When executed, this JavaScript attempts to access a file hosted on another server. When users visit compromised Web sites, their systems are directed by Scrob to download a file containing malicious code such as Trojan horses and keystroke loggers from a Russian Web site."

Director of malicious code at iDefens Ken Dunham said: "IIS servers are first compromised and then configured to host malicious JavaScript in the footer of Web pages hosted on the server. End users simply surf Web sites hosted by the IIS server and get infected with additional malicious code."

Cooper added: "Rather than being an attack targeted at specific sites, this appears to be an attempt by the hackers to find any vulnerable IIS server they can break into. My belief is that the attackers were trying to do this very quietly maybe using bots. They didn't really care what IIS boxes were getting compromised."


Confusion remains over how widespread the infections are. According to Marty Lidner, an incident-handling team leader at the CERT Coordination Center at Carnegie Mellon University in Pittsburgh: "CERT found infections on about 100 Web sites of varying sizes yesterday and informed their operators of the problem. But many other Web sites are likely to be infected that CERT is unaware of. The number also doesn't include end-user systems that may have been compromised from visiting infected Web sites."

According to Dunham: "hundreds of thousands of computers are likely to have been infected in the past 24 hours."

Lidner added: "The incident once again serves to demonstrate the need for due diligence when it comes to security. This stuff happens all the time. People tend to lose sight of that."