Malware Alert?

Sears · Post by **Sears** » Tue Mar 27, 2012 1:26 pm

Got a complaint that people are getting forwarded to malware sites or something when they try and load 1911. Is this happening to anyone else? I can't replicate it at all, so I'm having a hard time trying to figure out what the problem might be.

Assuming it's brazilian trickery...

defiance · Post by **defiance** » Tue Mar 27, 2012 1:43 pm

I've heard up to like 10 people getting it. Their web browser stops them from even getting here, so they are just closing 1911 so they probably wont see this.

Sears · Post by **Sears** » Tue Mar 27, 2012 1:49 pm

Mother fucker. Thanks.

Probably take the site down for awhile today to try to eradicate whatever the fuck it is.

lolinus · Post by **lolinus** » Tue Mar 27, 2012 2:01 pm

Name of site redirecting too?

defiance · Post by **defiance** » Tue Mar 27, 2012 2:16 pm

They aren't actually being redirected, they get some warning that 1911 is trying to redirect them to a malware site or something, and it just stops there.

I swear i sent sears a PM with information like the IP address to whatever its trying to do, but i dont see it in my outbox.
3SidedQuarter has it, if that PM didnt go through.

lolinus · Post by **lolinus** » Tue Mar 27, 2012 2:17 pm

I tried with explorer running in sandbox on lowest security level. It will redirect to some random site promting to install "flash player" in order to view some random celeberty sex video.

Dosen't get redirected when using chrome, opera or firefox, just internet explorer.

Has the httaccess file some input that shouldn't be there? Is the DNS okay?

defiance · Post by **defiance** » Tue Mar 27, 2012 2:18 pm

Narc just sent me this, it might solve something. Dont know if clicking it would be a smart idea. He said this is what his virus scanner pops up as when he tries to come here.

Narc: http://nineteeneleven.org/wp-content/th ... rotate.php
Process:C:\Program Files\Internet Explorer\iexplore.exe
Infection:HTML:Script-inf

Sears · Post by **Sears** » Tue Mar 27, 2012 2:21 pm

Well, what happened is that Dreamhost had an outage last week. Lots of corrupted stuff in the backend since then, so I'm thinking that this stuff has something to do with that. Thanks for the help guys, should be able to get it figured out.

Sears · Post by **Sears** » Tue Mar 27, 2012 2:59 pm

Ok, found a few code injections that looked like they came from a bot, removed anything I could find that might have caused any problems, htaccess is clear.

Can you guys try and see if it's still happening?

defiance · Post by **defiance** » Tue Mar 27, 2012 3:08 pm

defiance: try and go to 1911 on IE
defiance: see if it works
defiance: sears thinks he fixed it
Narc: nope

Narc: Infection Details

URL:http://nineteeneleven.org/
Process:C:\Program Files\Internet Explorer\iexplore.exe
Infection:HTML:Script-inf

scorch- · Post by **scorch-** » Tue Mar 27, 2012 3:10 pm

Pretty sure this was only happening yesterday? My work AV was blocking access yesterday morning due to "HEUR: Trojan.Script.General" or something along those lines, but I was able to access in the afternoon so I didn't bother messaging you when I was home.

edit: JK. I just tried to access via IE and got the following message:

Kaspersky
Anti-Virus 2010
Access denied
The requested URL could not be retrieved

While trying to retrieve the URL:

http://nineteeneleven.org/forums/

The following threat was encountered:

The requested object is INFECTED with the following viruses: HEUR:Trojan.Script.Generic

Generated:
3:10:47 PM
Kaspersky Anti-Virus 2010

But chrome lets me access fine.

t`RavE · Post by **t`RavE** » Tue Mar 27, 2012 3:14 pm

Just tried it Sandboxed in IE too... got redirected again. This time was something about Anti-Virus security installation.

lolinus · Post by **lolinus** » Tue Mar 27, 2012 3:15 pm

I think chrome is blocking it, while ie(as we all know blows dick) is not blocking it.

Jb_ · Post by **Jb_** » Tue Mar 27, 2012 3:19 pm

I switched to firefox and it works fine.

Sears · Post by **Sears** » Tue Mar 27, 2012 3:19 pm

I found a couple code-injections, but I keep finding more. Looks like they got us site wide. Had to have happened during the Dreamhost "datacenter downtime". Mother fuckers.

But yeah, Chrome/firefox/safari seem to block it, where as it gets straight through with IE.

It looks like I'm going to have to take EVERYTHING DOWN and do clean installs just to get all of the php injections out. That probably won't happen until late tonight.

lolinus · Post by **lolinus** » Tue Mar 27, 2012 3:22 pm

You cant just roll back?

Sears · Post by **Sears** » Tue Mar 27, 2012 3:25 pm

lolinus wrote:You cant just roll back?

Nope

lolinus · Post by **lolinus** » Tue Mar 27, 2012 3:28 pm

Sears wrote:
lolinus wrote:You cant just roll back?
Nope

Really no backup?

Sears · Post by **Sears** » Tue Mar 27, 2012 3:34 pm

lolinus wrote:
Sears wrote:
lolinus wrote:You cant just roll back?
Nope
Really no backup?

I think you are misunderstanding what I'm saying. All of the data is backed up, but I have to re-install fresh versions of the two scripts that power 1911 (wordpress + phpbb).

Literally every single php file on the server was injected. I'm assuming via a backdoor in wordpress or phpbb. So, I can't really prevent it from happening again either.

Pretty close to just closing the site down, fuck you cunts.

toxinatoR · Post by **toxinatoR** » Tue Mar 27, 2012 3:35 pm

who the hell uses ie.

t`RavE · Post by **t`RavE** » Tue Mar 27, 2012 3:51 pm

toxinatoR wrote:who the hell uses ie.

Schmiggs · Post by **Schmiggs** » Tue Mar 27, 2012 4:07 pm

I am still getting it eric. The plus side is i now know where to go if i want to see pics and vids of raunchy girlfriends...

defrag · Post by **defrag** » Tue Mar 27, 2012 4:15 pm

All I gotta say is...

HAVE FUN

I'd give you more than my single digit rep if I could for your time and effort, but unfortunately the system you designed does not allow me to do so at the present time.

Also, on a sidenote when going to the 1911.org homepage, I notice I end up blocking the following IP:

72.21.91.19

This IP belongs to all of the following sites:

http://www.robtex.com/ip/72.21.91.19.html#ip

I noticed a bunch of wordpress stuff, and malware related sites, among legitmate ones as well. I am not sure how this IP is associated with 1911, but maybe you could shed some light on that.

Edit: more info on that IP: http://malwaresurvival.net/2011/05/11/a ... ware-site/

Sears · Post by **Sears** » Tue Mar 27, 2012 5:05 pm

Schmiggs wrote:I am still getting it eric. The plus side is i now know where to go if i want to see pics and vids of raunchy girlfriends...

I know, I'm not going to be able to get rid of it completely until I take everything down and put it back up from scratch. Literally every php file on the server is infected.

cassinoroyale · Post by **cassinoroyale** » Tue Mar 27, 2012 6:22 pm

Yay I use chrome/opera (mobile)... Brazi here isn't infected! And Eric don't get mad, have some neat reps!

james- · Post by **james-** » Tue Mar 27, 2012 6:28 pm

Firefox wouldn't let me connect to the site a couple times yesterday. Just gave me a timed out error. However it worked on my phone.

Duno if that means anything o.o

motive · Post by **motive** » Tue Mar 27, 2012 6:29 pm

Sears wrote:
Schmiggs wrote:I am still getting it eric. The plus side is i now know where to go if i want to see pics and vids of raunchy girlfriends...
I know, I'm not going to be able to get rid of it completely until I take everything down and put it back up from scratch. Literally every php file on the server is infected.

If you haven't fixed this yet then pm me because this can probably get resolved with a fancy sed call, provided you actually have SSH access

seanality · Post by **seanality** » Thu Mar 29, 2012 9:04 am

Ya I was trying to get on here from work and our symantec was giving me a huge warning and redirecting.

1911 Beta

Malware Alert?

Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?

Re: Malware Alert?