[SOLVED/FIXED] Malware on bestblackhatforum.com ??! Please READ everyone! Thanks!

[ccpaleadvipp]

Finally the malware was been COMPLETELY REMOVED.

Code:

http://sitecheck.sucuri.net/results/http://www.bestblackhatforum.com

and for google safebrowsing

Code:

http://www.google.com/safebrowsing/diagnostic?site=www.bestblackhatforum.com

The malware injected was on the outside of the php files.
It is a malware being called from the php.ini file

This is the malicious iframes i found


These specific strings aren’t typically found anywhere in the website files, which is very concerning. We’re finding that entire servers are being compromised, and the main server php.ini file (/etc/php/php.ini) has the following setting added:

Code:

;auto_append_file = “0ff”

This simple line in the php.ini makes all the php scripts append the output of the file 0ff (/tmp/0ff) to them. So even if your files look clean, the malware is still displayed to anyone visiting the site.

This is the code of the 0ff file:


In my case i found the 0ff file from usr/share/pear/

Took me hard enough to clean the entire site.
But good thing we're back now. Finally site was been totally 100% clean and free from malware. Thank you everyone for the help.

[lala]

Hi everyone!
The SuperVIP Chatbox was already been fixed too and enabled again for supervip. Enjoy!


-Lala

[StevieRay]

FOUND THIS ON GOOGLE GUESS YOU WANT TO KNOW......

BestBlackhatForum.com Sucks !!!: 21

wiki.nexus.edu.my/groups/pllc/revisions/.../21/ - Vertaal deze pagina

IF WE FIND BEST BLACKHAT FORUM DELETING ANY MORE POSTS, WE WILL. SHUT YOUR SITE DOWN WITH A DOS ATTACK AND MALWARE ATTACK!

BestBlackHatForum.com SUCKS !

wiki.nexus.edu.my/groups/pllc/weblog/bae77/ - Vertaal deze pagina22 Aug 2011 – Best Blackhat Forum Sucks !!! #######################################################. EVERYBODY WHO HAS HAD THEIR ...

WAR HAS BEEN DECLARED RIGHT?

bbhf wil ne#ve#r die!!

CopyMyCash

[StevieRay]

Found this on google! Guess you would like to know!

BestBlackHatForum.com SUCKS !

wiki.nexus.edu.my/groups/pllc/weblog/bae77/ - Vertaal deze pagina22 Aug 2011 – Best Blackhat Forum Sucks !!! #######################################################. EVERYBODY WHO HAS HAD THEIR ...



CopyMyCash

BBHF WILL NEVER DIE!

[content_is_king_2021]

im just happy the forum is back online and ready to rock!

good job on fixing this baby up you guys! keep it up.

[jello]

Thx for your great support!

[The Thor Hammer]

Thanks Admin and Lala for the great effort in solving these issues....

Bestblackhatforum ROCKS !

Cheers !

[maniboy]

wwwwwwooooooooo hhhhhhhhhhhhhooooooooooooooooo the victory is bestblackhatforum's admin. You guys ROCK!!!! Glad we're all back online.

[azzizzy]

Thanks Admin and Lala for managing to get rid of this problem
I was blockt from vsiting the site once becuse firfox said MALWARE
was being downloade on my computer. So I am glad it as been sorted now.

[Ynwaps]

How is this a victory?
Site got infected, no serp anymore, site for 72h+ not aviable.