(no subject)

["Aditya Deshmukh" <aditya.deshmukh () online gateway strangled net>]

Recently 2 days ago I saw this in a compromised system. 


Both this file and cpshost.dll were deleted from C:\InetPub\scripts
This file was recovered but I was unable to recover cpshost.dll.... 


Anyone know what is this ? 






<% Response.Buffer = TRUE %>

        Version=1.5
<%
        PathToPA = "http://"; + Request.ServerVariables("SERVER_NAME") +
"/scripts/cpshost.dll"


        PostingURL = PathToPA + "?PUBLISH"
                
        TargetURL = "http://"; + Request.ServerVariables("SERVER_NAME")
%>

        [{8B14B770-748C-11D0-A309-00C04FD7CFC5}]
        PostingURL="<%= PostingURL %>"
        TargetURL="<%= TargetURL %>"
        ComponentInstall="yes"


________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/