BEWARE! Sites getting injected with malicious code!!

Ok I tried to open it in Ubuntu 7.10. Gedit showed:

<br />
<b>Warning</b>:  gzinflate() [<a href='function.gzinflate'>function.gzinflate</a>]: data error in <b>/usr/home/master/domains/cl-amg-63.com/public_html/counter/getfile.php</b> on line <b>0</b><br />
<br />
<b>Warning</b>:  gzinflate() [<a href='function.gzinflate'>function.gzinflate</a>]: data error in <b>/usr/home/master/domains/cl-amg-63.com/public_html/counter/getfile.php</b> on line <b>0</b><br />
Ž

Code (markup):

I visited the cl-amg-63.com website and has the same malicious code and ip as hu1-hu1.cn.

Then, I tried to open it with KPDF and it just said it can't open it.

I don't have Wine installed, but if it runs windows programs, maybe it would work in ubuntu.


Also, WINDOWS USERS: VISIT THIS PAGE:

http://www.threatexpert.com/report.aspx?uid=b01be624-a6e9-4a71-b6f4-0810d0598ed8

 

has this been resolved?

all my websites hosted with one hosting company has the virus thing..they are all wordpress blogs and when i log on kaspersky detected this and blocked it...im contacting my hosting company now and they are always slow to respond.

 

fuck, my site infected too..what can i do, i just search how to solve the problems

 

fuck virus.............

 

Here is a script that seems to clean the affected files:

Use it at your own risk...I've not created the script(Not even tested it). Don't open it with your browser, use SSH!

http://forums.permaculture.org.au/v...a&sid=ff8b562bb134309ccb6280357ea7e96d#p45211

 

im infected and need help to get it off my site!

 

They Are Doing It Unethically. Chinese Websites Are Worst In This Case. Each And Every Site Is Spreading Malwares

 

yea i found someone who can fix it! for about $20

 

It seems to have affected my site www.squashnorthland.co.nz - it is a wp site

anyone had any luck fixing the problem?

 

Also anyone know how sites are getting affected?

 

What does this virus actually do?

 

thanks for your warning...

 

Oooo, I hate malicious code injection but everything from my end seems fine.

It's good that my our servers never got hit... (Hmm, asking for it.. Nah)

I am sorry to hear what happened, hope all goes well .

~ Mike

 

wow good thing i never visited it.. I received an email with the same url.. YIKES

 

It's a trojan

 

my antivirus detects it has a virus

 

Has anyone figured out how to fix it yet?

 

Hi Guys.

Try using the script on this page to get rid of the problem

http://www.webhostingtalk.com/showthread.php?p=5407476

My host used it and it seems to have gotten rid of the problem.

 

Thanks For this Usefull information... I going to re-check all my site, Now...

 

Thanks for the heads up.