Trojan code being written to an index file - GoFuckYourself.com

Furious_Male · 07-15-2006, 08:56 AM

Sorry to cross post but I don't think this thread is being seen by enough eyes and the tech savvy guys can probably give some additional input.

http://www.gofuckyourself.com/showthread.php?t=611063

Thank you.

Just Jace · 07-15-2006, 09:00 AM

yup, seen that tons lately

let me find someone that figured out how to fix it...brb

Just Jace · 07-15-2006, 09:02 AM

here you go - gofuckyourself.com/showthread.php?t=624858&highlight=javascript+troja n

Quote:

Originally Posted by m4yadult

Change your FTP password, remove the script at the bottom of the page that runs the iframe:

[code=trojan stuff on your pages]
<script language="JavaScript">
e = '0x00' + '22';str1 = "%99%C1%CA%
blah blah blah
</script>
[/code]

You might have your host run a check to see what other files were modified at the same time. Pattern to look for is:

Login, Get File, Put File, Get File, Put File, Logout

usually no failed password attempts.

Sources for your password leak: People that have installed software for you in the past, anyone that has had FTP access to your machine, possibly any keylogger on your system.

The script forces the installation of an "start.exe" which connects to a site hosted at "inhoster.com". I donhahaha180;t think ithahaha180;s worth to contact them if you have a look at their site.

The site called us-counter.com and dnv-counter.com belong to a guy from Ukraine and are blacklisted with several records. IPhahaha180;s from the sites and from the hosting company are pretty much the same.

Just Jace · 07-15-2006, 09:04 AM

a better thread about it

gofuckyourself.com/showthread.php?t=613700&highlight=javascript+troja n

Furious_Male · 07-15-2006, 09:04 AM

Thanks a million Just Jace I am going to pass that on to my hosting companies tech dept.

Just Jace · 07-15-2006, 09:06 AM

Quote:

Originally Posted by Furious_Male

Thanks a million Just Jace I am going to pass that on to my hosting companies tech dept.

anytime darling

07-15-2006, 08:56 AM	#1
Furious_Male Doing the grind since 99 Industry Role: Join Date: Oct 2003 Location: Buffalo NY Posts: 16,883	Trojan code being written to an index file Sorry to cross post but I don't think this thread is being seen by enough eyes and the tech savvy guys can probably give some additional input. http://www.gofuckyourself.com/showthread.php?t=611063 Thank you. __________________ Living in Virtual Reality Contact: Email (preferred): furiousmale .at. gmail - Skype: live:shanedws

07-15-2006, 09:00 AM	#2
Just Jace Confirmed User Join Date: Jul 2006 Location: Atlanta, Ga. Posts: 239	yup, seen that tons lately let me find someone that figured out how to fix it...brb __________________ Do you have a blog that does over 1000 uniques a day? Contact me to make more money with it icq:102893553 aol:jacejacejacejace

07-15-2006, 09:04 AM	#4
Just Jace Confirmed User Join Date: Jul 2006 Location: Atlanta, Ga. Posts: 239	a better thread about it gofuckyourself.com/showthread.php?t=613700&highlight=javascript+troja n __________________ Do you have a blog that does over 1000 uniques a day? Contact me to make more money with it icq:102893553 aol:jacejacejacejace

07-15-2006, 09:04 AM	#5
Furious_Male Doing the grind since 99 Industry Role: Join Date: Oct 2003 Location: Buffalo NY Posts: 16,883	Thanks a million Just Jace I am going to pass that on to my hosting companies tech dept. __________________ Living in Virtual Reality Contact: Email (preferred): furiousmale .at. gmail - Skype: live:shanedws