Hi all,
I've inherited site that uses framework ver 1.14322 and along with it came a backdoor code (ASPXSpy) that allows user to pretty much view/edit/delete any file or resources.
The result was that some of the JS files on the site get code added to the bottom of it:
"src=http://www.oldrockhousestl.com/images/ken.gif"
which is in reality another JS file.
I didn't even notice until google started marking site as security risk.
I thought I cleaned all of this but it keeps reappearing, and from what I can see .net is recompiling the code.
I think I located some of the stuff in the Temporary ASP.NET Files, like pb8iq3ef.0.cs, it has all the code of the backdoor script and it's trying to write it to a file in a site folder. There are also few other files with same name but different extensions (cmdline, dll, err, out, pdb, res) .
I really need some help with getting to th ...
Go to the complete details ...