efm-vogue - Fixed Web Site Trogan/Virus Infection

[tomg]

AVG is now reporting my website free of all Trogan/Virus'. Somehow, someone installed the Framer Z script. It has been removed.

It was only the web site that was infected. The downloads were and are safe.

I could not find any info on Framer Z outside of AVG picking it up. If you know something speak up.

------------------------------------------------------------------------


My latest SE project.

_classic emulation +
_low cpu
_working wheels
_extended classic + phrase Arp

Enjoy

http://www.ele4music.com/vst/efm-vogue.zip


[mod edit: I don't know whether you've removed all the malware, but just in case I've edited the URL and IMG contents above. Feel free to change them back (and to delete this message) when you're sure nothing wicked that way comes.]

Thank you! Even though these particular links were always clean it's good to be safe. I've been to every page on my site and AVG reports it clean so I've restored the links. If anyone gets another warning I'll disable them again.

[ouroboros]

Sweet Tom, thanks! Will post some more later

[SWTrex]

Thanks for the freebie...will try it later.

I clicked on your "www" link and received a virus alert from F-Secure saying

Code: Select all

Malicious code found in file C:\DOCUMENTS AND SETTINGS\SZ175P\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D59VCFKP\ELE4MUSIC[1].HTM.
Infection: Trojan-Downloader.HTML.Agent.ij
Action: The file was deleted.
Virus Detected.  Please contact your local Service Desk.

I cleared my cache and tried it again with the same result.

Behind the message box, a page loaded with the address:

http://www.ele4music.com/efm/

The page title was "WordPress" and contained a notice saying something about an error establishing a database connection.

After clearing the message box, I reloaded the page (Shift-F5). The same page reloaded with no virus message.

Anyone else get this?

SWTrex

[stanlea]

I download everything from you. Thanks Tom.

[MrM]

..

Anyone else get this?

SWTrex

No, a 'Error establishing a database connection' error.

[mhemnarch]

Thanks for the freebie...will try it later.

I clicked on your "www" link and received a virus alert from F-Secure saying

Code: Select all

Malicious code found in file C:\DOCUMENTS AND SETTINGS\SZ175P\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D59VCFKP\ELE4MUSIC[1].HTM.
Infection: Trojan-Downloader.HTML.Agent.ij
Action: The file was deleted.
Virus Detected.  Please contact your local Service Desk.

I cleared my cache and tried it again with the same result.

Behind the message box, a page loaded with the address:

http://www.ele4music.com/efm/

The page title was "WordPress" and contained a notice saying something about an error establishing a database connection.

After clearing the message box, I reloaded the page (Shift-F5). The same page reloaded with no virus message.

Anyone else get this?

SWTrex

I got that.

[tomg]

Thanks for the freebie...will try it later.

I clicked on your "www" link and received a virus alert from F-Secure saying

Code: Select all

Malicious code found in file C:\DOCUMENTS AND SETTINGS\SZ175P\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D59VCFKP\ELE4MUSIC[1].HTM.
Infection: Trojan-Downloader.HTML.Agent.ij
Action: The file was deleted.
Virus Detected.  Please contact your local Service Desk.

I cleared my cache and tried it again with the same result.

Behind the message box, a page loaded with the address:

http://www.ele4music.com/efm/

The page title was "WordPress" and contained a notice saying something about an error establishing a database connection.

After clearing the message box, I reloaded the page (Shift-F5). The same page reloaded with no virus message.

Anyone else get this?

SWTrex

I got that.

I think your virus checkers went nuts because my wordpress database went down for a short time. It's working now. Try again please.

[pattonfreak1]

I'm at work tom and I got a virus detection (via Norton) when I visited your page and checked out Stompshop...
Whassup wit dat?

[tomg]

I'm at work tom and I got a virus detection (via Norton) when I visited your page and checked out Stompshop...
Whassup wit dat?

That sucks! I think I found it though... Please try again and let me know if I got it.

Someone changed this...

Code: Select all

<META HTTP-EQUIV="Refresh"
      CONTENT="1; URL=http://www.ele4music.com/efm/">

To this...

Code: Select all

<META HTTP-EQUIV="Refresh"
      CONTENT="1; URL=http://www.ele4music.com/efm/">
<script>eval(unescape("[mod edit: deleted script segment to be on the safe side]")); </script>

[SWTrex]

Just tried it again. This time, your page loads ("EFM electronics for music") but I still get a message from F-Secure:

Code: Select all

Malicious code found in file C:\DOCUMENTS AND SETTINGS\SZ175P\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\4C2ZF59D\EFM[1].HTM.
Infection: Trojan-Downloader.HTML.Agent.ij
Action: The file was renamed.
Virus Detected.  Please contact your local Service Desk.

SWTrex

[Polite Company]

Yea, Zone Alarm keeps catching a Trojan anytime I visit the page.

[datapark]

alright, i'll be waiting on this one... :p

[tomg]

Just tried it again. This time, your page loads ("EFM electronics for music") but I still get a message from F-Secure:

Code: Select all

Malicious code found in file C:\DOCUMENTS AND SETTINGS\SZ175P\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\4C2ZF59D\EFM[1].HTM.
Infection: Trojan-Downloader.HTML.Agent.ij
Action: The file was renamed.
Virus Detected.  Please contact your local Service Desk.

SWTrex

Got it! Thanks it was buried in index.php.

[tomg]

alright, i'll be waiting on this one... :p

It's safe to come over now..

[buscemi]

Move to Movable Type and truly be safe. Wordpress installs that aren't updated within a day of the latest security update are oft-hacked.