What 3rd party modules do you have installed?

---

www.server-essentials.com is a community for IT Consultants and Business Owners who, themselves, take care of the IT infrastructure and Employees who do that little extra in the company to keep things running. Our forum is for discussing all things ‘IT’ and more. Our documentation is top notch and written by and for the community. Join now at https://www.server-essentials.com/secure-registration

One of the 3 instances infected is a clean DNN 8.0.0 instance without any other third party installed, so I eliminate the third party issue.

 I changed all the FTP password.

I removed this code from web.config :

<rewrite>
  <rules>
    <rule name="1" patternSyntax="ECMAScript" stopProcessing="true">
      <match url="^$" ignoreCase="true" negate="false" />
      <conditions logicalGrouping="MatchAny" trackAllCaptures="false">
        <add input="{HTTP_USER_AGENT}" pattern="Googlebot|Yahoo|MSNBot|bingbot" />
      </conditions>
      <action type="Rewrite" url="bot.asp" />
    </rule>
  </rules>
</rewrite>

 And I removed any PHP version from the web site properties (applications pool), I use a shared hosting (Arvixe).

I will check if there is a new xxxx.asp file creates tomorrow.

 Thanks.

Antoine.