Spyware Warrior

Elektra · Posted: Fri Jul 13, 2007 5:12 pm Post subject: spam on my page?

OK, recently some of my friends who visited my site said that every time they went on it their firewall would go off. Well I figured out a couple of weeks ago what it was. On every "index.php" page(and one or two .htm/.html pages) this link would appear at the bottom of the page. I deleted it from every index page it appeared on. This afternoon it reappeared and I deleted it again.

But it's back for a THIRD time:

suzi · Posted: Fri Jul 13, 2007 6:41 pm Post subject:

Elektra,

It would appear your website has been hacked. Somehow hackers gained access to it and added code to the pages.

Is your website on a shared server, sometimes called virtual hosting? Or do you have a dedicated server for your site?

Who is in charge of the server?

Also, if you are using a php program, like Wordpress, or a php forum, for example, and the progams are not updated to the laterst versions, they can be hacked due to vulerabliities in the software.

You should contact the webhosting company right away and explain what has been happening.

Unfortunatly website hacking has become more and more common in the last year. Hackers will hack anything they can get into and use it for malicious purposes.

The IP address in that iframe link belongs to known internet criminals.

http://whois.domaintools.com/81.95.145.240

I can't get this page to load right now, but it tells the history of these criminals.
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL43489

I will look at your site in my virtual machine and see if I can find any more info, but you you need to contact your hosting company right away and tell them what happened. They should be able to help you secure your site, or secure their servers to prevent the hackers from getting back in.

Is it the site in your homepage link? If so, I would request you to remove the link from your profile because we don't want anyone clicking on it from here and getting infected with a trojan.

Thanks.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

Elektra · Posted: Fri Jul 13, 2007 6:54 pm Post subject:

*headdesk* Hacked? Aghhh this sucks so much Sad

OK, I will contact my web hosting company right away.

And umm, I'm not sure who's in charge of the server, how do I find that out?

And thanks for the links, I'll take a look at those

Elektra · Posted: Fri Jul 13, 2007 7:33 pm Post subject:

suzi · Posted: Fri Jul 13, 2007 7:47 pm Post subject:

Unless you are paying for a virtual private server or have a dedicated server, the hosting company is responsible for the server, but you are responsible to keep the applications updated, like if you have a blog, or a forum.

Ask you hosting company what you should do, because it depends on how they work. I don't know that you should totally delete it, but the hosting company should tell you what to do. You, or they, might be able to block access to it while it gets cleaned up and secured.

Could you send me a PM with the URL again? I see you removed it from your profile, thanks for doing that. I actually went there with my good machine and I got firewall alerts, but no alerts from my AV. I want to check it again on my virtual machine.

Yes, having your website hacked really does suck, but it's happening to a lot of sites, I mean hundreds of thousands of sites.

I recommend you read this:

http://www.stopbadware.org/home/security

See section 5: 5. Hacking attacks to your site

It talks about invisible iframes, which is what is on your site.

It happened to this guy, too. He explains it in his blog:

http://ethanzuckerman.com/blog/?p=1346

Good luck. If you need help explaining to your hosting company what's going on, let me know. I sometimes contact companies about getting hacked sites taken down and cleaned up.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

Elektra · Posted: Fri Jul 13, 2007 7:51 pm Post subject:

Oh, well I contacted already basically paraphrasing what I said here, I said I got hacked of course. I also mentioned this site too.

The support e-mail said they usually get back within two hours, so maybe if they need more info or I need help I'll ask if you could also contact them.

I'm hosted at http://godaddy.com/

And thanks for the more info! Smile

suzi · Posted: Fri Jul 13, 2007 7:52 pm Post subject:

Oh, in the quote, they are talking about that IP address, not saying you should take down your site.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

Elektra · Posted: Fri Jul 13, 2007 8:01 pm Post subject:

olliver · 81.95.145.240

ld · Posted: Sat Jul 14, 2007 3:31 pm Post subject:

I'm not sure why a notepet wasn't able to reach the site but unfortunately I had no problem.

suzi · Posted: Sat Jul 14, 2007 8:41 pm Post subject:

That site is monitoring IPs and if you try to go there a second time, it says your IP is blocked. That's not terribly unusual either. Nice of them to not exploit you more than once. Rolling Eyes

I wanted to see what it would do to my totally unpatched XP Pro vm. Mpack is bad news.

Good write up here:

http://www.symantec.com/enterprise/security_response/weblog/2007/05/mpack_packed_full_of_badness.html

More info here:
http://www.infoworld.com/article/07/07/05/Mpack-installs-ultrainvisible-Trojan_1.html

The OP here is getting some behind the scenes help with this in case anyone was wondering.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

JeanInMontana · Posted: Sat Jul 14, 2007 9:29 pm Post subject:

I was going to suggest Essex hosting. ChrisRLG and his gang do nothing but help with this type situation and monitor sites.
_________________

Hoax~Slayer * hpHosts * T.I.C. * Malwarebytes

olliver · Posted: Sun Jul 15, 2007 12:18 am Post subject:

olliver · Posted: Sun Jul 15, 2007 12:28 am Post subject:

olliver · Posted: Sun Jul 15, 2007 12:50 am Post subject:

ld · Posted: Sun Jul 15, 2007 8:02 am Post subject:

You are right, it does look at the User Agent string of your browser. Change it to something like "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" and you will get much different results. The blocks seem to be on a page by page basis. This obfuscated javascript links to several files on another server on the same /16. When I tried to get a directory listing I get the message that I was blocked. Tried from a different IP and got the same javascript I'm analyzing now(so no directory listing it spit index.php at me). Back to my original IP that is blocked I grabbed the .jar file and had no problem getting it. The IP blocking is just to keep you from executing the same script multiple times but won't keep you from getting the other dangerous files you have not yet recieved... When you decode that javascript it starts by loading a java applet and then has a decent size javascript to run. Going by the applets name it sounds like it is an exploit for MS0-311 which deals with a bug in the microsoft virtual machine and is from 2003. At the very end you see a link to a page ms07-017.php which the name sounds like a GDI exploit. There is a lot more going on in there those are just the things that stand out.