04-21-2012, 12:41 AM
Finally the malware was been COMPLETELY REMOVED.
![[Image: cleanbbhf.png]](http://img685.imageshack.us/img685/7676/cleanbbhf.png)
and for google safebrowsing
The malware injected was on the outside of the php files.
It is a malware being called from the php.ini file
This is the malicious iframes i found
![[Image: 21669806.png]](http://img801.imageshack.us/img801/8395/21669806.png)
These specific strings aren’t typically found anywhere in the website files, which is very concerning. We’re finding that entire servers are being compromised, and the main server php.ini file (/etc/php/php.ini) has the following setting added:
This simple line in the php.ini makes all the php scripts append the output of the file 0ff (/tmp/0ff) to them. So even if your files look clean, the malware is still displayed to anyone visiting the site.
This is the code of the 0ff file:
![[Image: iframei.png]](http://img38.imageshack.us/img38/7580/iframei.png)
In my case i found the 0ff file from usr/share/pear/
Took me hard enough to clean the entire site.
But good thing we're back now. Finally site was been totally 100% clean and free from malware. Thank you everyone for the help.
Code:
http://sitecheck.sucuri.net/results/http://www.bestblackhatforum.comand for google safebrowsing
Code:
http://www.google.com/safebrowsing/diagnostic?site=www.bestblackhatforum.comThe malware injected was on the outside of the php files.
It is a malware being called from the php.ini file
This is the malicious iframes i found
These specific strings aren’t typically found anywhere in the website files, which is very concerning. We’re finding that entire servers are being compromised, and the main server php.ini file (/etc/php/php.ini) has the following setting added:
Code:
;auto_append_file = “0ff”This simple line in the php.ini makes all the php scripts append the output of the file 0ff (/tmp/0ff) to them. So even if your files look clean, the malware is still displayed to anyone visiting the site.
This is the code of the 0ff file:
In my case i found the 0ff file from usr/share/pear/
Took me hard enough to clean the entire site.
But good thing we're back now. Finally site was been totally 100% clean and free from malware. Thank you everyone for the help.
