JS:Illredir-DW

Viruses and worms
1

Avast! Internet Security detected the JS:Illredir-DW trojan on this web address:

hxxp://blogs.zooniverse.org/wp-includes/js/tinymce/plugins/tabfocus/DD_belatedPNG_0.0.7a-min.php

This occurred when I opened the blogs page at Zooniverse for the first time.

Avast says it blocked the Trojan. Assuming it protected my computer, is there anything I should do? Will my install of Avast notify someone at Avast of this problem, so they can contact the Zooniverse staff to have the trojan removed? Or should I attempt to contact the Zooniverse staff myself? Can I do so safely? How?

2

Avast doesn’t contact sites as there are literally thousands of site infected per day. So if you have any contact at zooniverse you should give them a heads up.

This is a very handy site, http://sitecheck.sucuri.net/scanner/ just enter the URL and that returns a detailed analysis of what it finds.

There have been a number of wordpress vulnerabilities which has resulted in many sites being hacked, so it is important to ensure they have the latest version of wordpress. See image as this also indicates an out of date wordpress and the site being infected…

3

Please can you modify the link, to prevent others potentially becoming infected. (change http to hXXp) Thanks.

That specific file is one long line of code that looks suspect to me…

Virustotal result: http://www.virustotal.com/file-scan/report.html?id=8f6a18cdd09949f227894ccb03f9c9c5e1e3098b2b6ad24d491835d0515ac6cc-1317849574

Only avast detects it (Gdata use the avast engine)

Maybe we could get some more info from avast…

4

Hi alisonnic,

Code has to do with a Wordpress vulneralibility, a so-called js unpacker bug hack; It goed through following steps-like

  1. Decoding option browser →
  2. Decoding option navigator.systemLanguage=en and navigator.systemLanguage=zh-cn →
  3. setAttribute src → var newurl] URL= →
    Well that is what the hack is trying to perform and then searching for the right bit of code of this malware, we can determinate it as described here: http://sucuri.net/malware/malware-entry-mwjs457
    So mentioned site was hacked to perform a downloader worm alias Iframer type of worm infection redirect via “newurl etc.”, mostly found at the end of the code or given obfuscated within the malcoded javascript,

polonus