Index.asp file overwritten / files placed on server.

[reisende]

Hi everyone.

Something very odd happened to our web site over the weekend and I was wondering if anyone had seen this before or may have an idea as to what happened.

When I got in this morning one of the Help Desk guys said that our public web site was only displaying "core-project".

I logged into the web server and sure enough there were three new files in the

http://wwwroot

folder. There was a new index.htm and index.html as well as a file called core.html. None of these files had existed before and were all created at the same time, about 1:40 AM.

I opened the source of these and they each only contained the following line:

core-project[]

What is more our existing index.asp file had been overwritten to display the same text as the before mentioned three newly created files.

I am assuming that we were either hacked or infected by a virus. I'm leaning toward the second option due to the uniformity of the changes.

If anyone has seen this before or has an idea as to what exactly may have happened, please let me know.

Thanks in advance.