FYI...
Htaccess redirection - malware ...
-
http://blog.sucuri.n...fo-dot-com.html
November 14, 2011 - "Since last week we started to see a large increase in the number of sites compromised with a .htaccess redirection to hxxp ://sweepstakesandcontestsinfo .com/ nl-in .php?nnn=555. This domain has been
used to distribute malware for a while (generally through javascript injections), but only in the last few days that we started to see it being done via .htaccess... anyone that visits the compromised sites from a search engine
will get redirected (and some times have their personal computer compromised). This is what happens on the browser of the visitor:
• Visits compromised site by clicking from a search engine
• Browser is redirected to sweepstakesandcontestsinfo.com/nl-in.php?nnn=555 (and variations)
• Browser is redirected to hxxp ://www4.personaltr-scaner.rr.nu/?gue5mx=i%2BrOmaqtppWomd%2FXxa.. (or www3 .bustdy .in or www3 .strongdefenseiz .in and variations)
• Browser is again redirected to hxxp ://rdr.cz.cc/ go.php?6&uid=7&isRedirected=1 (and other domains)
From there, it can be sent to online surveys
(hxxp ://www.nic.cz.cc/redir2/?hxxp ://surveyfinde.com/d/local-job-listings .net),
malware web sites, fake search engines and anywhere the attackers decide.
>> If your site is compromised, check your .htaccess to see if it was modified.
If you are not sure, run a scan on your site here:
-
http://sitecheck.sucuri.net
... we are seeing it being used in combination with timthumb.php attacks and on outdated Joomla/WordPress sites. So you have make sure all of them are updated to avoid getting reinfected. *Also, the site is -
not- blacklisted by Google (or in any major blacklist)..."
? -
http://forums.whatth...=...st&p=757571
____
Bash commands to detect script injections and malware
-
http://www.malwaredo...rdpress/?p=2184
November 14th, 2011 - "This was posted a while ago on stopbadware and it’s too good not to repost… The first one will find any javascript file that contains the string “eval(unescape” which is the most common way of injecting malicious code. The second is a similar method for PHP files (source*)... If you run a CMS, making this a “cron” script to run on a regular interval may not be a bad idea* .. (Note: Linux only… If anyone is running the equivalent commands on windows, please let us know)... [In addition to using a “sitecheck” service like sucuri...]"
*
https://badwarebuste...ries/show/20712
"Not so long ago my site and other domains hosted on my server were injected with malware PHP scripts that caused all sorts of damage, including amending javascript files to display ads to people who visited my sites. The scripts also self-replicated, and accepted commands from an external source to run on my server. These 2 bash commands saved my life and I would like to share them with the world. The first one will find any javascript file that contains the string “eval(unescape” which is the most common way of injecting malicious code. The second is a similar method for PHP files.
find . -name “*.js” | xargs grep -l “eval(unescape”
find . -name “*.php” | xargs grep -l “eval(base64_decode”
Seek and destroy!"
Edited by AplusWebMaster, 14 November 2011 - 10:11 PM.
Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
