Hi Aditya On 9/28/05, Aditya Deshmukh <[EMAIL PROTECTED]> wrote: > Recently 2 days ago I saw this in a compromised system. > > > Both this file and cpshost.dll were deleted from C:\InetPub\scripts > This file was recovered but I was unable to recover cpshost.dll.... > > > Anyone know what is this ? >
It is a upload script, cpshost.dll is the Posting Acceptor ActiveX control : http://support.microsoft.com/kb/q230298/ > > <% Response.Buffer = TRUE %> > > Version=1.5 > <% > PathToPA = "http://"; + Request.ServerVariables("SERVER_NAME") + > "/scripts/cpshost.dll" > > > PostingURL = PathToPA + "?PUBLISH" > > TargetURL = "http://"; + Request.ServerVariables("SERVER_NAME") > %> > > [{8B14B770-748C-11D0-A309-00C04FD7CFC5}] > PostingURL="<%= PostingURL %>" > TargetURL="<%= TargetURL %>" > ComponentInstall="yes" > ciao ciao ademar _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
