[konrath]

[QUOTE=ramzex;541109]Crap!

This is not the iframe method!
We had exact same issues our our customers webservers.
We have investigated this issue and found the following:

Hello

I do not agree with you.

------------------------------
3. Script has modified the passwords of the accounts located in /etc/passwd
------------------------------

The passwords of the customers are not modified.


What I see in this log (sent by sallen812) is exactly what happens to my clients infected with iframe hack.



Thank you
Konrath