The Realm of Jinan

Bad Javascript, Bad.Filed Under: General, Programming, Web Development

Well, last hour or so has been interesting. I was going to my website I was working on http://gadsdenwifi.org and my antivirus popped up a notice saying it deleted a temporary internet file.  I shrugged it off (as I had other tabs open and thought it was one of others.  After a bit I noticed that my computer was starting to run slow and sluggish.  Thats when I noticed acrobat.exe using 800 megs of ram and slowly climbing.  Also thats when I noticed sysguard.exe in my process list.  No surprise to me some anti spyware program popped up and started running on my computer (spyware protect 2009).  Running combo fix took care of that problem.  So after fixing the spyware issue, I started playing around with the newly uploaded database information. I then decided to change the test site around just a bit.  I uploaded index.php and got a message saying that the file on the server was newer than the last uploaded one, so I went to check it out.  Thats when I found this nice little bugger:

Some reason, every index.php file on my webserver had this code enbedded around a few php eco statements, which caused my antivirus to pop up warning me that there was a trojan trying to infest my computer.  All infected files have been removed and everything should be normal (I hope).

We shall see in the next couple of days.

Tags: acrobat, combo fix, exploit, Gadsden, javascript, malicious, security, spyware protect 2009, Wifi