Malware on my site - GoFuckYourself.com

slowloris · 11-29-2010, 08:59 PM

Hi,

Google is reporting Malware on some of my sites and has removed them from its index.

It only seems to be affecting php pages. Google webmaster tools states in could not find any malicious code on the site so it's not javascript of an iframe. I've checked out .htaccess and httpd.conf as google suggested and found nothing out of the ordinary. The sites do not redirect me only people in the US and Europe from what I can gather so far.

Does anyone have any suggestions as to how this might be occurring or where else I could look? My server admin is running a virus scan on the server at the moment so hopefully that will sort it out.

If anyone wants to check it out for themselves one of the sites is http://www.gay-spa.com/ (Gay Content Warning!!!, and be careful of anything which tries to install) I would be interested to see if people are still getting redirected and how persistent the virus / worm / whatever is.

I'm trying to decide whether I should turn off apache until the virus scan is complete to protect my surfers, but as I don't really know what is happening I'm not sure if that is an over reaction or not. If anyone is brave enough to check out the url and click on a few links and let me know what happens I'd be grateful!

Thanks!

Agent 488 · 11-29-2010, 09:04 PM

What happened when Google visited this site?
Of the 8 pages we tested on the site over the past 90 days, 3 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-11-29, and the last time suspicious content was found on this site was on 2010-11-29.
Malicious software is hosted on 3 domain(s), including roadstersaverstore.com/, get4-domain.cz.cc/, get3-domain.cz.cc/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including pornomet.com/.

slowloris · 11-29-2010, 09:11 PM

Yeah I have other sites with more pages reported as redirecting to malicious software. Also a site which google claims is being used as an intermediary site to download malicious software. So there it must be hiding files somewhere on my domains which redirect users from other compromised servers to the final download site?

The google siteadvisor thing is also claiming one of my sites infected several others? How is that possible I'm not sure? Is there some kind of worm spreading from server to server? Have my ftp details been compromised?

slowloris · 11-29-2010, 09:15 PM

Does the following imply that my site has infected the other sites? This is what I don't understand?

For this site:-

http://www.google.com/safebrowsing/d...nggaysites.com

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, shockinggaysites.com appeared to function as an intermediary for the infection of 5 site(s) including gayandguy.com/, moviesboy.net/, moregaytwinks.com/.

baddog · 11-29-2010, 09:18 PM

Running open-x?

slowloris · 11-29-2010, 09:20 PM

Yes I did have an old version of it on there I deleted it yesterday. Is OpenX just generally unsafe as I am still using the latest version on the server.

Which versions are unsafe? I deleted 2.0

carzygirls · 11-29-2010, 11:03 PM

maybe you have your answer now. If not, I suggest going to the google forum and posting your question there. Just beware, there are a lot of senseless and moronic people on that board, you need to filter out those and find your answer with the ones that know what they are talking about. gl

botfurom · 11-29-2010, 11:10 PM

Get me out of here!!

slowloris · 11-29-2010, 11:21 PM

Well I'm assuming the old openx installation is how what ever got in, got in, I just don't understand how some of the sites I'm trading with are starting to go down 1 by 1 as well.

I have had little luck with the google forum in the past when trying to figure out why all the Smart Thumbs sites got deleted from their index. It took almost a few days to get the attention of anyone with half a brain and that was with lots of affected webmasters posting regularly. In fact I think the only reason a google employee even noticed it was because it got up to several hundred replies.

This is the reason I am posting here first. I seriously cannot understand what is telling apache to redirect or even if the redirects are still occurring. Perhaps it is occuring at a lower level than apache since all config files look ok and I can find no bad code in any php file?

I'll see what happens with the virus check and then post to googles message board if nothing comes up.

baddog · 11-29-2010, 11:49 PM

Quote:

Originally Posted by slowloris

Yes I did have an old version of it on there I deleted it yesterday. Is OpenX just generally unsafe as I am still using the latest version on the server.

Which versions are unsafe? I deleted 2.0

If you are running any version, google the exploit. There are two different ways to deal with it, depending on the version you are/were using.

If not using or when fix, notify google of what the problem was and what you did to fix it. It will take a few hours (to a few days) after you notify them for the alert to go away.

MasterM · 11-30-2010, 12:53 AM

google openx exploit : 635.000 results
damn

http://www.mindraven.com/blog/php/openx-exploit/

slowloris · 11-30-2010, 03:33 AM

I know there is a shitload of exploits for previous versions of openx - I did delete the really old copy yesterday and found there was actually an upgrade to the other two copies I was running which I already thought were up to date, but which now, actually are up to date.

But what I would really like to know is if anyone is still being redirected to the malware pages?

Come on - there must be some brave soul out there who can handle gay content, and is familiar with what to do when it tries to penetrate your system. Tell me - does any of the links at http://www.gay-spa.com/ try to mislead you, and attach its agenda to your OS?

11-29-2010, 08:59 PM	#1
slowloris Registered User Join Date: Aug 2004 Location: NZ Posts: 45	Malware on my site Hi, Google is reporting Malware on some of my sites and has removed them from its index. It only seems to be affecting php pages. Google webmaster tools states in could not find any malicious code on the site so it's not javascript of an iframe. I've checked out .htaccess and httpd.conf as google suggested and found nothing out of the ordinary. The sites do not redirect me only people in the US and Europe from what I can gather so far. Does anyone have any suggestions as to how this might be occurring or where else I could look? My server admin is running a virus scan on the server at the moment so hopefully that will sort it out. If anyone wants to check it out for themselves one of the sites is http://www.gay-spa.com/ (Gay Content Warning!!!, and be careful of anything which tries to install) I would be interested to see if people are still getting redirected and how persistent the virus / worm / whatever is. I'm trying to decide whether I should turn off apache until the virus scan is complete to protect my surfers, but as I don't really know what is happening I'm not sure if that is an over reaction or not. If anyone is brave enough to check out the url and click on a few links and let me know what happens I'd be grateful! Thanks!

11-29-2010, 11:10 PM	#8
botfurom Confirmed User Industry Role: Join Date: Oct 2010 Location: Wherever Posts: 482	Get me out of here!! __________________ Hate chat traffic? Referred to us and earned $3.7 every sale!!! You have craiglist traffic? Give us a shot we pay $40 PPS. ICQ: 629933616 Yahoo: danicacmp Email: [email protected]

11-29-2010, 09:04 PM	#2
Agent 488 Registered User Industry Role: Join Date: Feb 2006 Posts: 22,511	What happened when Google visited this site? Of the 8 pages we tested on the site over the past 90 days, 3 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-11-29, and the last time suspicious content was found on this site was on 2010-11-29. Malicious software is hosted on 3 domain(s), including roadstersaverstore.com/, get4-domain.cz.cc/, get3-domain.cz.cc/. 1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including pornomet.com/.

11-29-2010, 09:11 PM	#3
slowloris Registered User Join Date: Aug 2004 Location: NZ Posts: 45	Yeah I have other sites with more pages reported as redirecting to malicious software. Also a site which google claims is being used as an intermediary site to download malicious software. So there it must be hiding files somewhere on my domains which redirect users from other compromised servers to the final download site? The google siteadvisor thing is also claiming one of my sites infected several others? How is that possible I'm not sure? Is there some kind of worm spreading from server to server? Have my ftp details been compromised?

11-29-2010, 09:15 PM	#4
slowloris Registered User Join Date: Aug 2004 Location: NZ Posts: 45	Does the following imply that my site has infected the other sites? This is what I don't understand? For this site:- http://www.google.com/safebrowsing/d...nggaysites.com Has this site acted as an intermediary resulting in further distribution of malware? Over the past 90 days, shockinggaysites.com appeared to function as an intermediary for the infection of 5 site(s) including gayandguy.com/, moviesboy.net/, moregaytwinks.com/.

11-29-2010, 09:18 PM	#5
baddog So Fucking Banned Industry Role: Join Date: Apr 2001 Location: the beach, SoCal Posts: 107,089	Running open-x?

11-29-2010, 09:20 PM	#6
slowloris Registered User Join Date: Aug 2004 Location: NZ Posts: 45	Yes I did have an old version of it on there I deleted it yesterday. Is OpenX just generally unsafe as I am still using the latest version on the server. Which versions are unsafe? I deleted 2.0

11-29-2010, 11:03 PM	#7
carzygirls So Fucking Banned Industry Role: Join Date: Oct 2010 Posts: 857	maybe you have your answer now. If not, I suggest going to the google forum and posting your question there. Just beware, there are a lot of senseless and moronic people on that board, you need to filter out those and find your answer with the ones that know what they are talking about. gl

11-29-2010, 11:21 PM	#9
slowloris Registered User Join Date: Aug 2004 Location: NZ Posts: 45	Well I'm assuming the old openx installation is how what ever got in, got in, I just don't understand how some of the sites I'm trading with are starting to go down 1 by 1 as well. I have had little luck with the google forum in the past when trying to figure out why all the Smart Thumbs sites got deleted from their index. It took almost a few days to get the attention of anyone with half a brain and that was with lots of affected webmasters posting regularly. In fact I think the only reason a google employee even noticed it was because it got up to several hundred replies. This is the reason I am posting here first. I seriously cannot understand what is telling apache to redirect or even if the redirects are still occurring. Perhaps it is occuring at a lower level than apache since all config files look ok and I can find no bad code in any php file? I'll see what happens with the virus check and then post to googles message board if nothing comes up.

11-30-2010, 12:53 AM	#11
MasterM Confirmed User Join Date: Oct 2002 Location: netherlands Posts: 248	google openx exploit : 635.000 results damn http://www.mindraven.com/blog/php/openx-exploit/

11-30-2010, 03:33 AM	#12
slowloris Registered User Join Date: Aug 2004 Location: NZ Posts: 45	I know there is a shitload of exploits for previous versions of openx - I did delete the really old copy yesterday and found there was actually an upgrade to the other two copies I was running which I already thought were up to date, but which now, actually are up to date. But what I would really like to know is if anyone is still being redirected to the malware pages? Come on - there must be some brave soul out there who can handle gay content, and is familiar with what to do when it tries to penetrate your system. Tell me - does any of the links at http://www.gay-spa.com/ try to mislead you, and attach its agenda to your OS?