resolved

[system]

resolved

[system]

Make the infected link non-clickable by changing www to wXw

The site is infected

9/13/2009 3:58:08 AM SYSTEM 1840 Sign of "HTML:Illiframe [Trj]" has been found in "http://www.yesqube.com/(S(vmtrprizxmm4bxftoiyr53y0))/Index.aspx" file.  

It’s a common occurance right now but one posibility:
http://blog.avast.com/2009/06/03/gumblarcn-summary

[system]

Hi siv,

Your website has been hacked.

http://www.UnmaskParasites.com/security-report/?page=www.yesqube.com/(S(vmtrprizxmm4bxftoiyr53y0))/Index.aspx

Near the top of the page, just after the opening body tag, there is a hidden iframe linking to a malicious site.
The iframe also tries to avoid scanning by redrecting to port 8080, but this obviously doesn’t work, as avast! has cought it

---

A very good post to read by DavidR:

@DavidR post:2

Actually cleaning the file is not going to resolve why you got hacked it will only clean the file (well avast doesn’t clean the file just alerts to it, you have to find and strip out the injected code) and not the cause, you need to contact your host, see below.

– HACKED SITES - This is commonly down to old content management software being vulnerable, see this example of a HOSTs response to a hacked site.

We have patched up the server and we found a weakness in PHP which was helping aid the compromise of some domains. We updated it, and changed some default settings to help prevent these coding compromises. The weaknesses were not server wide but rather just made it easier on a hacker to compromise individual end user accounts.

I suggest the following clean up procedure for both your accounts:

1. check all index pages for any signs of java script injected into their coding. On windows servers check any “default.aspx” or
   “default.cfm” pages as those are popular targets too.

2. Remove any “rouge” files or php scripts uploaded by the hackers into your account. Such scripts allowed them to make account wide
   changes, spam through your account, or spread their own .htaccess files through all of your domains in that end user.

3. Check all .htaccess files, as hackers like to load re-directs into them.

4. Change all passwords for that end user account. The cp password, the ftp password, and any ftp sub accounts. Make sure to use a
   “strong” password which includes upper case, lower case, numbers and NO COMPLETE WORDS OR NAMES!

This coupled with our server side changes should prevent any resurfacing of the hackers efforts. In some cases you may still have coding which allows for injection. All user input fields hidden or not should be hard coded, filtered, and sanitized before being handed off to php or a database which will prevent coding characters from being submitted and run through your software.

Also see, Tips for Cleaning & Securing Your Website, http://www.stopbadware.org/home/security.

-Scott-

[sejtko]

The site is infected as spg SCOTT and YoKenny told you. I have just made the picture, so I’ll show you the infection too. Just look at the attached picture, it is shown using red arrows.

Regards

[system]

Hi,
thks a lot… will look into that and do corrective action

[DavidR]

The main issue is not just removing the injected code but renoving the vulnerability that is being exploited.

This is commonly old content management software, PHP, SQL, Wordpress, etc. etc.

[system]

my website is crrupted by 0x0000054 try to resolve it

[DavidR]

We can’t resolve problems on your web site.

Besides there is zero information to go on, like full details of the problem and a little thing like a URL, we can’t even guess what is wrong with your site.

File corruption isn’t something avast can fix, it is an anti-virus.

You should create a new topic of your own in the General forum (http://forum.avast.com/index.php?board=1.0) if this is not a virus detection/alert by avast and we will try to help if we can. However, we will need a lot more information.