'Insurance' Code injection attack

[Sati]

Hi All,
Does anyone know how to clean a asp application from a
virus that converts labels with the word 'Insurance' into
link button to a web page. It also injects text in the
textbox when the textbox.text has any reference to
this 'insurance' word.

I am using custom controls on custom page. This injection
seems to be occurring after the pre-render event.
Thanks in advance.

[Oliver]

Is it database driven? It sounds like someone made a bad mistake updating
the database.

"Sati" <an*******@disc ussions.microso ft.com> wrote in message
news:02******** *************** *****@phx.gbl.. .

Hi All,
Does anyone know how to clean a asp application from a
virus that converts labels with the word 'Insurance' into
link button to a web page. It also injects text in the
textbox when the textbox.text has any reference to
this 'insurance' word.

I am using custom controls on custom page. This injection
seems to be occurring after the pre-render event.
Thanks in advance.

[Wayne]

"Sati" <an*******@disc ussions.microso ft.com> wrote in message
news:02******** *************** *****@phx.gbl.. .

Hi All,
Does anyone know how to clean a asp application from a
virus that converts labels with the word 'Insurance' into
link button to a web page. It also injects text in the
textbox when the textbox.text has any reference to
this 'insurance' word.

I am using custom controls on custom page. This injection
seems to be occurring after the pre-render event.

Download SpyBot S&D and perhaps even HackThis! as it sounds more like you
have a spybot of some sort active.

[sati]

Thanks.. and yes, the page gets the data from SQL server
2000. And no, its not from the Database or even the Web
server. Its local to the client browser and seems to be in
the IE browser.

Even in the client machine, if we look at the html source
code, this injection code does not exist. If this is true
than I have no way of knowing how the page is getting
rendered on the client machine.

Seems like a BIG security Flaw in IE.

-----Original Message-----
Is it database driven? It sounds like someone made a bad mistake updatingthe database.

"Sati" <an*******@disc ussions.microso ft.com> wrote in messagenews:02******* *************** ******@phx.gbl. ..

Hi All,
Does anyone know how to clean a asp application from a
virus that converts labels with the word 'Insurance' into link button to a web page. It also injects text in the
textbox when the textbox.text has any reference to
this 'insurance' word.

I am using custom controls on custom page. This injection seems to be occurring after the pre-render event.
Thanks in advance.

.

[John Saunders]

"sati" <an*******@disc ussions.microso ft.com> wrote in message
news:0d******** *************** *****@phx.gbl.. .

Thanks.. and yes, the page gets the data from SQL server
2000. And no, its not from the Database or even the Web
server. Its local to the client browser and seems to be in
the IE browser.

Even in the client machine, if we look at the html source
code, this injection code does not exist. If this is true
than I have no way of knowing how the page is getting
rendered on the client machine.

Seems like a BIG security Flaw in IE.

If it is a security flaw in IE, then you seem to be the first to find it.

--
John Saunders
John.Saunders at SurfControl.com

[Oliver]

It sounds like that machine or the proxy server has a bad version cached.

If you clear the cache and tell IE to get a new page every time does it fix
it?
"sati" <an*******@disc ussions.microso ft.com> wrote in message
news:0d******** *************** *****@phx.gbl.. .

Thanks.. and yes, the page gets the data from SQL server
2000. And no, its not from the Database or even the Web
server. Its local to the client browser and seems to be in
the IE browser.

Even in the client machine, if we look at the html source
code, this injection code does not exist. If this is true
than I have no way of knowing how the page is getting
rendered on the client machine.

Seems like a BIG security Flaw in IE.

-----Original Message-----
Is it database driven? It sounds like someone made a bad

mistake updating

the database.

"Sati" <an*******@disc ussions.microso ft.com> wrote in

message

news:02******* *************** ******@phx.gbl. ..

Hi All,
Does anyone know how to clean a asp application from a
virus that converts labels with the word 'Insurance' into link button to a web page. It also injects text in the
textbox when the textbox.text has any reference to
this 'insurance' word.

I am using custom controls on custom page. This injection seems to be occurring after the pre-render event.
Thanks in advance.

.

[Dino Chiesa [Microsoft]]

This is weird, it looks like the work of a smart tag installed on IE. . .
But there's no such animal?

Do you get the same behavior on all client machines? Or only some?
On the affected machines, Are there any BHO's installed?

http://www.definitivesolutions.com/bhodemon.htm

-D

"Sati" <an*******@disc ussions.microso ft.com> wrote in message
news:02******** *************** *****@phx.gbl.. .

Hi All,
Does anyone know how to clean a asp application from a
virus that converts labels with the word 'Insurance' into
link button to a web page. It also injects text in the
textbox when the textbox.text has any reference to
this 'insurance' word.

I am using custom controls on custom page. This injection
seems to be occurring after the pre-render event.
Thanks in advance.