Rasulullah shallallahu 'alaihi wasallam telah bersabda: "Barang siapa mengajak kepada kebaikan, maka ia akan mendapat pahala sebanyak pahala yang diperoleh orang-orang yang mengikutinya tanpa mengurangi pahala mereka sedikitpun. Sebaliknya, barang siapa mengajak kepada kesesatan, maka ia akan mendapat dosa sebanyak yang diperoleh orang-orang yang mengikutinya tanpa mengurangi dosa mereka sedikitpun." (HR. Shahih Muslim)
As yesterday, I found unknown code at the bottom of each wordpress file (javascript and homepage index files). Furthermore, the Javascript code will load malicious file from other remote servers, which are randomized. It works similar to Gumblar virus, though it has slightly different codes and action.
So far, I’ve found this javascript malicious code with different var value. Nhbk5v835x5dq6, H3qqea3ur6p, and Jqjzlgspz98uxl.
This code will load another malicious script from http://xtube-com.blogger.com.pornorama-com.bluejackmusic.ru:8080/hdfcbank.com/hdfcbank.com/google.com/fanpop.com/in.com/
This code will load another malicious script from http://live.com.google.com.baidu-msn.com.bestartsale.ru:8080/wordpress.com/google-mail.it/livejasmin-photobucket.com/cnet-cnn.com/about-ebay.com/
This code will load another malicious script from http://google-cn.msn.ca.shoplocal-com.easymusicstore.ru:8080/interia.pl/interia.pl/google.com/empflix.com/debonairblog.com/
Some of WordPress, Joomla, and Pligg users have reported this problem in several forums. I’ve successfully cleaned this virus from my iPhone blog and ryan-isra.net as well. This tutorial will guide you how to disinfect your WordPress blog from this virus.
It’s very recommended to have Notepad++ application installed in your Windows to make this process easier.
You can download Notepad++ from this link.
1. Login to cPanel (if applicable)
2. Edit the content of index.php in root directory to be any text (i.e. Under Maintenance) to protect your visitors of being infected.
3. Create a zip file of wp-content directory, download it to local computer and extract it.
4. Use search feature and find all javascript files in wp-content folder.
5. Open Notepad++, then select all files in Search Results screen. Drag all files into Notepad++’s window.
6. Press CTRL+H key, paste the javascript malicious code in “Find what” field and leave empty the “Replace with” field.
7. When finished, click File – Save All or simply press CTRL+SHIFT+S key.
8. Repeat the step#4 and change *.js to *index*
9. Repeat the step#8 and change *index* to *default*
10. Remember the path of each file and then re-upload each file to its own path.
11. Get a fresh copy of wordpress, copy wp-admin and wp-includes directories, compress, and upload to your hosting.
12. Replace wp-admin and wp-includes directories in your hosting with the one that you just uploaded.
13. Now, ensure that your computer is clean of virus/keylogger/trojan and then change your cPanel/FTP password.
The process could be simpler if you have never changed/customized any of your wordpress theme/plugins. You could simply re-upload a fresh wordpress installation, themes, plugins.
I am so sleepy, sorry if something is wrong or missing.
- Update -
Please see these comments, some of them may help you better than my post.
Thanks guys.
what most people search here: ryan-isra net, xtube virus, wordpress javascript virus, xtubes com, javascript virus, javascript virus code, MALicious javascript download, javascript malicious code, javascript virus wordpress, israa org (file sarche), gumblar fix wordpress, virus javascript code
Allahu A'lam. Allah Maha Mengetahui.
Semua kesalahan yang ada di blog ini datangnya dari kesalahan dan lalainya manusia (saya sendiri), mohon koreksinya kalau dirasa ada yang salah.
Related posts:
Worked a treat….well done and thank you.
Are you hosted on 1and1?
You're welcome.
Nope.
However, this is client issue.
If anyone is looking for the same code but on a unix server, this worked for me:
to list the files:
find . -exec grep "GNU GPL" '{}' ; -print
to find and replace them:
find . -type f | xargs perl -pi -e 's//*GNU GPL.*{}$/
/g'
It will basically find anything that starts with
*GNU GPL
and finishes with
{}
Cheers
Hi Daniel, Thanks for the bash|shell command.
Unfortunately, my hosting prevent me to upload php command shell and I haven’t request for SSH access yet :(
Thanks again, Daniel ;)
Anyone care to/able to explain how this happened?
If you see my previous post, there are some links, which are helpful (for me).
I have code that removes the virus from any infected webpage: you can get it here:
http://seoforums.org/site-optimization/118-script…
BUT BE SURE TO CHANGE ALL YOUR FTP PASSWORDS IMMEDIATELY, THEY HAVE BEEN COMPROMISED.
It’s modified version of gumblar removal tools, isn’t it?
Thank you so much, Martin.
It was written by a friend of mine, he is in the attribution at the top of the text, Im not sure what he based the code on but if its similar its a good guess!
perhaps you could link to that page with the fix in your main article so that others can find it?
thanks!
Martin
As the author of the script mentioned, I can say that it was written from scratch. I had to find a quick solution for fixing about a hundred of sites infected. Though it has various incompatibilities with some servers and is heavy on server resources it was well-tested by me and Martin on bunch of sites and as far as I can see it helps much.
So I hope it can be useful for many people.
I love the internet! Thank you for this well documented fix. Worked like charm. Still in the dark here though as to how that got on the website. Really no clue…
Cheers.
Tnx a lot m8,
Do you have any idea about how did we get that virus? Maybe over FTP or Browser?
Hi predrage,
You could read previous posts, there are some useful links.
Hey thanks for the information, helped me a lot. May I ask how you figured out those scripts will load malicious files from other website?
Read my previous post, when my blogs were being infected.
I used the modified Konstantin's script on win hosting site, Joomla CM. Just commented out the backup part and it worked.
1000+ files were infected per site.
Tried also on localhost with apache server – copy the site on localhost, run the script without .tar backup. Works fine.
Thank you guys, especially Ryan & Konstantin.
Hey Martin I tried that curevir.php for some reason it did not work for me. It looks I will have to follow that Notepad++ method.