Sucuri Security » Malware http://sucuri.net Protect your interwebs! Wed, 22 Feb 2012 16:16:45 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Malware entry: MW:JS:JJ677 http://feedproxy.google.com/~r/SucuriSecurityMalware/~3/3N9PJESlbpY/malware-entry-mwjsjj677 http://sucuri.net/malware/malware-entry-mwjsjj677#comments Fri, 10 Feb 2012 19:08:37 +0000 dcid http://sucuri.net/?post_type=malware&p=1854 Continue reading →]]> Description:

A suspicious and encoded javascript was found. It used the jjencoder to hide its content, but we detected a hidden call to load content from remote web sites in attempt to exploit a specific browser vulnerability.
 
Note that any PHP, HTML and JS file gets compromised by this malware. Sometimes it can also be hidden inside the database.
 
Affecting: Any web site. Often on outdated WordPress, Joomla and osCommerce sites.

Clean up: You can also sign up with us and let our team remove the malware for you.
 
Loads malware from multiple sources:

no domain specified
(and many other domains).

 

Malware dump (sample of malware):

]]> 0 http://sucuri.net/malware/malware-entry-mwjsjj677 Malware entry: MW:IFRAME:ENC1560 http://feedproxy.google.com/~r/SucuriSecurityMalware/~3/93T7ZzytXys/malware-entry-mwiframeenc1560 http://sucuri.net/malware/malware-entry-mwiframeenc1560#comments Wed, 08 Feb 2012 17:23:07 +0000 dcid http://sucuri.net/?post_type=malware&p=1846 Continue reading →]]> Description:

A hidden and dangerous iframe was identified. It loads content from remote web sites in attempt to exploit a specific browser vulnerability. In some variations, the browser is redirected to blackhat seo spam sites. It is also known as “Exploit:HTML/IframeRef.AA” by some anti virus products.
 
Note that every PHP, HTML and JS file gets compromised by this malware.
 
Affecting: Any web site. Often on outdated WordPress, Joomla and osCommerce sites.

Clean up: You can also sign up with us and let our team remove the malware for you.
 
Loads malware from multiple sources:

http://tds83.1dumb.com/stds/go.php?sid=1
http://pokosa.com/tds/go.php?sid=1
(and many other domains).

 

Malware dump (sample of malware):

]]> 0 http://sucuri.net/malware/malware-entry-mwiframeenc1560 Malware entry: MW:BLACKLISTED:35 http://feedproxy.google.com/~r/SucuriSecurityMalware/~3/PCk7fzR5QKU/malware-entry-mwblacklisted35 http://sucuri.net/malware/malware-entry-mwblacklisted35#comments Mon, 06 Feb 2012 19:05:46 +0000 dcid http://sucuri.net/?post_type=malware&p=1820 Continue reading →]]> Description:

A suspicious code was identified loading content from a blacklisted domain. Example of domains include:

abcdecorez.cx.cc
kokosina.in
www.ironydon.co.cc
solid-success.in
ewinarfm.co.be
companyairline.ru
broadway.bee.pl
search-box.in
fairbankhouston.cz.cc
secondon.in
aht-textile.ru
hhwsdfhshds.co.cc

And many others. Those types of code are often used to distribute malware from external web sites while not being visible to the user.

 

Signature:

This is not a signature-based rule, but looks at our Blacklist to identify malicious content.

 

Affecting:

Any web site sites (no specific target)

 

Clean up:

This malware is generally hidden inside the HTML or PHP files. Sign up here to get it clean up: Signup

 

Malware dump (sample of malware):

]]> 0 http://sucuri.net/malware/malware-entry-mwblacklisted35 Backdoor: PHP:PREG_REPLACE:EVAL http://feedproxy.google.com/~r/SucuriSecurityMalware/~3/-hQ0vnT-TxI/backdoor-phppreg_replaceeval http://sucuri.net/malware/backdoor-phppreg_replaceeval#comments Tue, 31 Jan 2012 14:55:07 +0000 dcid http://sucuri.net/?post_type=malware&p=1810 Continue reading →]]> Description: We detected a malicious code hidden under a preg_replace with the “e” switch that acts as an eval call (code execution). It is often used to bypass simple detection methods that only look for “eval(” call itself.

Use: Hide spam, malware and backdoors.

Affecting: Any web site (often through outdated WordPress, Joomla, vBulletin, osCommerce and stolen passwords).

Clean up: You can also sign up with us and let our team remove the malware for you.

Malware dump: ]]> 0 http://sucuri.net/malware/backdoor-phppreg_replaceeval Backdoor: PHP:C99:045 http://feedproxy.google.com/~r/SucuriSecurityMalware/~3/FJs8qFUcTZg/backdoor-phpc99045 http://sucuri.net/malware/backdoor-phpc99045#comments Mon, 30 Jan 2012 17:08:27 +0000 dcid http://sucuri.net/?post_type=malware&p=1809 Continue reading →]]> Description: We detected the “C99″ backdoor that allows attackers to manage (and reinfect) your site remotely. It is often used as part of a compromise to maintain access to the hacked sites.

Affecting: Any web site (often through outdated WordPress, Joomla, osCommerce and stolen passwords).

Clean up: You can also sign up with us and let our team remove the malware for you.

Malware dump: ]]> 0 http://sucuri.net/malware/backdoor-phpc99045 Backdoor: PHP:R57:01 http://feedproxy.google.com/~r/SucuriSecurityMalware/~3/tsZ9_6YR7b8/backdoor-phpr5701 http://sucuri.net/malware/backdoor-phpr5701#comments Mon, 30 Jan 2012 17:05:09 +0000 dcid http://sucuri.net/?post_type=malware&p=1808 Continue reading →]]> Description: We detected the “R57″ backdoor that allows attackers to access, modify and reinfect your site. It is often hidden in the filesystem and hard to find without access to the server or logs.

Affecting: Any web site (common on compromised Joomla, osCommerce and WordPress sites)

Clean up: You can also sign up with us and let our team remove the malware for you.

Malware dump: ]]> 0 http://sucuri.net/malware/backdoor-phpr5701 Backdoor: PHP:EVAL:GZINFLATE:B64 http://feedproxy.google.com/~r/SucuriSecurityMalware/~3/Z4oZsOil2Yg/backdoor-phpevalgzinflateb64 http://sucuri.net/malware/backdoor-phpevalgzinflateb64#comments Mon, 30 Jan 2012 16:26:40 +0000 dcid http://sucuri.net/?post_type=malware&p=1807 Continue reading →]]> Description: We detected a highly encoded (and malicious) code hidden under a loop of gzinflate/gzuncompress/base64_decode calls. After decoded, it goes through an eval call to execute the code.

Affecting: Any web site (often through outdated WordPress, Joomla, vBulletin, osCommerce and stolen passwords).

Clean up: You can also sign up with us and let our team remove the malware for you.

Malware dump: ]]> 0 http://sucuri.net/malware/backdoor-phpevalgzinflateb64 Backdoor: PHP:GENERIC:07 http://feedproxy.google.com/~r/SucuriSecurityMalware/~3/kUXqWDe6PQI/backdoor-phpgeneric07 http://sucuri.net/malware/backdoor-phpgeneric07#comments Sat, 28 Jan 2012 11:14:17 +0000 dcid http://sucuri.net/?post_type=malware&p=1805 Continue reading →]]> Description: We detected a generic backdoor that allows attackers to upload files, delete files, access, modify and/or reinfect your site. It is often hidden in the filesystem and hard to find without access to the server or logs. It also includes uploadify scripts and similars that offer upload options without security.

Affecting: Any web site (often through outdated WordPress, Joomla, vBulletin, osCommerce and stolen passwords).

Clean up: You can also sign up with us and let our team remove the malware for you.

Malware dump: ]]> 0 http://sucuri.net/malware/backdoor-phpgeneric07 Backdoor: PHP:WEBSHELL:03 http://feedproxy.google.com/~r/SucuriSecurityMalware/~3/GgxwxMVt-4E/backdoor-phpwebshell03 http://sucuri.net/malware/backdoor-phpwebshell03#comments Sat, 28 Jan 2012 11:07:02 +0000 dcid http://sucuri.net/?post_type=malware&p=1804 Continue reading →]]> Description: We detected a generic web shell (backdoor) that allows attackers to access, modify and reinfect your site. It is often hidden in the filesystem and hard to find without access to the server or logs.

Affecting: Any web site (often through outdated WordPress, Joomla, osCommerce and stolen passwords).

Clean up: You can also sign up with us and let our team remove the malware for you.

Malware dump: ]]> 0 http://sucuri.net/malware/backdoor-phpwebshell03 Backdoor: PHP:Filesman:02 http://feedproxy.google.com/~r/SucuriSecurityMalware/~3/DUonm6cHvr8/backdoor-phpfilesman02 http://sucuri.net/malware/backdoor-phpfilesman02#comments Sat, 28 Jan 2012 10:53:03 +0000 dcid http://sucuri.net/?post_type=malware&p=1803 Continue reading →]]> Description: We detected the “Filesman” backdoor that allows attackers to access, modify and reinfect your site. It is often hidden in the filesystem and hard to find without access to the server or logs.

Affecting: Any web site (often through outdated WordPress, Joomla, osCommerce and stolen passwords).

Clean up: You can also sign up with us and let our team remove the malware for you.

Malware dump: ]]> 0 http://sucuri.net/malware/backdoor-phpfilesman02