https://www.icyphoenix.com/viewtopic.php?f=35&t=1939
-----------------------------------
KugeLSichA
Mon 14 May, 2007 22:25

Regarding Virus Trojaner on my site
-----------------------------------
Hello All,

some of you may noticed that on my site ( http://www.caromguild.de | http://www.caromonline.de )was an error with an Virus Trojan Downloader.

As the first user reported this error to me, i checked all files on the server -> didnt found anything, so i deleted all and reuploaded all files. Before, i checked with winmerge with the latest IP version and didnt found any evil code.

I never got such a message if i visit my forum... and so i thought that this could be related to a banner script code. So i first deactivated all banners -> no success, after that i deleted all banner -> no success.

Today i found the error. It comes from a folder where i didnt pay much attention on it. it was from the [b]_uc[/b] folder. which i use for/if i´m updating my site.
I this folder there is only a index.htm, logo, and style_sheet file.

The evil code was included in the index.htm  dont know how the hacker could inject this.

It was a VBScript code (if someone would have tht code to check it i can send it) which includes a file called lsass.exe . I wrote a email to the hoster where the file is located (is a normal board) and told him that he should delete this file

[color=#ff0033]I just want to inform you that, if you are using also the folder (which is included in the IP contribut folder) with the upgrading .htaccess file, that you should delete this folder from your server, if this is not used!!![/color]

Also i want to say sorry for the problem that the users may have be visiting my site.

greetz


-----------------------------------
hpl
Tue 15 May, 2007 01:19

Re: Regarding Virus Trojaner On My Site
-----------------------------------
Now I spoke with MG and he told me that those kind of viruses usually infect files [u]locally on the pc[/u] and when you upload them, the files are already infected...


-----------------------------------
KugeLSichA
Tue 15 May, 2007 15:47

Re: Regarding Virus Trojaner on my site
-----------------------------------
hello hpl,

i also thought this first. but i was wondering because the file local on my PC was [u]not infected[/u]

this also explains that local my forum works well but not online.


-----------------------------------
Antonio Mercurio
Tue 15 May, 2007 23:05

Re: Regarding Virus Trojaner On My Site
-----------------------------------
[quote user="KugeLSichA" post="14030"]hello hpl,

i also thought this first. but i was wondering because the file local on my PC was [u]not infected[/u]

this also explains that local my forum works well but not online.[/quote]


Long time ago I had the same problem:
an hacker, using a bug, has downloaded on my server a "backdoor" and with this program he gained full access to my ftp space, editing some file adding a malicious code.

The problem was related to some cross site scripting (so it is possible that the backdoor is not related to ICY but to some other script on another site).

Do you have register_globals set to on?


-----------------------------------
Mighty Gorgon
Wed 16 May, 2007 01:29

Re: Regarding Virus Trojaner on my site
-----------------------------------
I used to have a similar virus on my PC which has infected all php and html files... that's why I thought you could get the virus locally... anyway what Antonio is saying it is true, the virus can infect your site via some not secured script. If you could determine what is causing the issue, please notify it here.

Thanks


-----------------------------------
TheSteffen
Mon 21 May, 2007 10:00

Re: Regarding Virus Trojaner on my site
-----------------------------------
Hi [b]KugeLSichA[/b],

I wrote kaspersky a Email before your first post...

The answer
[quote]No malicious software was found on the link you have sent. 
Maybe, malware code was removed from server.[/quote]

But I think it wasn't right.

By the way, because of this I disabled your Logo under LINKS ;-)

You can enable it, if everything will be fine.  :mryellow:


-----------------------------------
KugeLSichA
Mon 21 May, 2007 21:12

Re: Regarding Virus Trojaner on my site
-----------------------------------
[quote user="TheSteffen" post="14500"]Hi [b]KugeLSichA[/b],

I wrote kaspersky a Email before your first post...

The answer
[quote]No malicious software was found on the link you have sent. 
Maybe, malware code was removed from server.[/quote]

But I think it wasn't right.[/quote]

Thx Steffen. 

[quote user="TheSteffen" post="14500"]
By the way, because of this I disabled your Logo under LINKS ;-)[/quote]

You disabled my logo? you think the error come from there?

greetz


-----------------------------------
TheSteffen
Tue 22 May, 2007 13:12

Re: Regarding Virus Trojaner on my site
-----------------------------------
[quote user="KugeLSichA" post="14578"][quote user="TheSteffen" post="14500"]
By the way, because of this I disabled your Logo under LINKS ;-)[/quote]

You disabled my logo? you think the error come from there?
[/quote]

No, but I also got a virus hint on the icyphoenix site because of this. And thats not so nice for other users ;-)


