Comments for ZYENWEB http://www.zyenweb.com Website design | Videography | Photography Wed, 10 Mar 2010 01:28:57 +0000 http://wordpress.org/?v=2.9.1 hourly 1 Comment on TROJAN ALERT! Illredir-B/Illredir-C/Illredir-D by LuisTim http://www.zyenweb.com/2010/01/19/trojan-alert-illredir-billredir-cillredir-d/comment-page-1/#comment-270 LuisTim Wed, 10 Mar 2010 01:28:57 +0000 http://www.zyenweb.com/?p=114#comment-270 Please, someone? Mike, can you upgrade your script please? :) Please, someone?
Mike, can you upgrade your script please? :)

]]> Comment on Trojan Attack: JS:Illredir-B [Trj] by Barak http://www.zyenweb.com/2009/12/30/trojan-attack-jsillredir-b-trj/comment-page-2/#comment-268 Barak Mon, 08 Mar 2010 11:17:52 +0000 http://www.zyenweb.com/?p=81#comment-268 My sites all starts to fall for this shit virus .... I cleaned it out by hand the files first, but still in some days they just all come back from somewhere. Apart from Avast there is not any antivirus even recognizing something is not okay. My version is mutated to Z already ... . What should I try to get rid of it? ... Did anyone get really completly rid of it? How did you make that happen? Thanks for your attention, B. My sites all starts to fall for this shit virus …. I cleaned it out by hand the files first, but still in some days they just all come back from somewhere. Apart from Avast there is not any antivirus even recognizing something is not okay. My version is mutated to Z already … . What should I try to get rid of it? … Did anyone get really completly rid of it? How did you make that happen?

Thanks for your attention,
B.

]]> Comment on Trojan Attack: JS:Illredir-B [Trj] by Hatem http://www.zyenweb.com/2009/12/30/trojan-attack-jsillredir-b-trj/comment-page-2/#comment-267 Hatem Sun, 07 Mar 2010 01:12:32 +0000 http://www.zyenweb.com/?p=81#comment-267 Hi everyone, the same as LuisTim said I had the same virus in my site, and it had changed many of things in my pages first of all I noticed that the buttons of the text editor of my forum (I use vbulletin) got frozen.. they give no action after clicking them, I thought my browser hanged or something then I opened my site from another PC and it is the same, and when I opened my forum control panel I found it not working properly, I mean when I click "submit" for something, it doesn't submitting, the same problem of the text editor happened to other 2 applications I use After getting a backup of my website on my PC, the NOD32 antivirus notified me that many files (most of them are index files as Mike said) are infected with ((js/trojandownloader.agent.nsm trojan)), and gave me 2 options: 1- Delete, 2- Rename (just renaming it from index.html to index.vhtml) these infected files are modified in march 1, 2010 Can anyone help??? P.S I'm running the script for more than 30 minutes ago and it just says: Running... PHP version: 4.4.9 Starting ... Is that normal?? thank you in advance best regards Hatem Hi everyone,
the same as LuisTim said
I had the same virus in my site, and it had changed many of things in my pages
first of all I noticed that the buttons of the text editor of my forum (I use vbulletin) got frozen.. they give no action after clicking them, I thought my browser hanged or something then I opened my site from another PC and it is the same,
and when I opened my forum control panel I found it not working properly, I mean when I click “submit” for something, it doesn’t submitting,
the same problem of the text editor happened to other 2 applications I use

After getting a backup of my website on my PC, the NOD32 antivirus notified me that many files (most of them are index files as Mike said) are infected with ((js/trojandownloader.agent.nsm trojan)), and gave me 2 options: 1- Delete, 2- Rename (just renaming it from index.html to index.vhtml)

these infected files are modified in march 1, 2010

Can anyone help???

P.S I’m running the script for more than 30 minutes ago and it just says:
Running… PHP version: 4.4.9
Starting …

Is that normal??

thank you in advance
best regards
Hatem

]]> Comment on Trojan Attack: JS:Illredir-B [Trj] by LuisTim http://www.zyenweb.com/2009/12/30/trojan-attack-jsillredir-b-trj/comment-page-2/#comment-266 LuisTim Fri, 05 Mar 2010 11:53:26 +0000 http://www.zyenweb.com/?p=81#comment-266 hi guys, I had this virus in my site and with Mike script I cleaned him and worked fine until now. Now I think that I have a new virus, because Mike script isnt clean my website… he cleaned some files but the website continues with virus :( Can someone tell me If is the same virus? My site is: http://www.filmes-terror.com I am using ESET NOD32 and he show me that virus name is: JS/TrojanDownloader.Agent.NSM trojan I installed AVAST in other PC and he show me that virus name is: [L] JS:Illredir-W [Trj] hi guys, I had this virus in my site and with Mike script I cleaned him and worked fine until now.
Now I think that I have a new virus, because Mike script isnt clean my website… he cleaned some files but the website continues with virus :(
Can someone tell me If is the same virus?
My site is: http://www.filmes-terror.com

I am using ESET NOD32 and he show me that virus name is:
JS/TrojanDownloader.Agent.NSM trojan

I installed AVAST in other PC and he show me that virus name is:
[L] JS:Illredir-W [Trj]

]]> Comment on TROJAN ALERT! Illredir-B/Illredir-C/Illredir-D by LuisTim http://www.zyenweb.com/2010/01/19/trojan-alert-illredir-billredir-cillredir-d/comment-page-1/#comment-265 LuisTim Fri, 05 Mar 2010 11:50:29 +0000 http://www.zyenweb.com/?p=114#comment-265 I installed AVAST in other PC and he show me that virus name is: [L] JS:Illredir-W [Trj] I installed AVAST in other PC and he show me that virus name is:
[L] JS:Illredir-W [Trj]

]]> Comment on TROJAN ALERT! Illredir-B/Illredir-C/Illredir-D by LuisTim http://www.zyenweb.com/2010/01/19/trojan-alert-illredir-billredir-cillredir-d/comment-page-1/#comment-264 LuisTim Fri, 05 Mar 2010 11:11:03 +0000 http://www.zyenweb.com/?p=114#comment-264 hi guys, I had this virus in my site and with Mike script I cleaned him and worked fine until now. Now I think that I have a new virus, because Mike script isnt clean my website... he cleaned some files but the website continues with virus :( Can someone tell me If is the same virus? My site is: http://www.filmes-terror.com I am using ESET NOD32 and he show me that virus name is: JS/TrojanDownloader.Agent.NSM trojan 05-03-2010 10:54:22 HTTP filter file http://www.filmes-terror.com/ JS/TrojanDownloader.Agent.NSM trojan connection terminated - quarantined Luis-PC\Luis Threat was detected upon access to web by the application: C:\Program Files\Mozilla Firefox\firefox.exe. hi guys, I had this virus in my site and with Mike script I cleaned him and worked fine until now.
Now I think that I have a new virus, because Mike script isnt clean my website… he cleaned some files but the website continues with virus :(
Can someone tell me If is the same virus?
My site is: http://www.filmes-terror.com

I am using ESET NOD32 and he show me that virus name is:
JS/TrojanDownloader.Agent.NSM trojan

05-03-2010 10:54:22 HTTP filter file http://www.filmes-terror.com/ JS/TrojanDownloader.Agent.NSM trojan connection terminated – quarantined Luis-PC\Luis Threat was detected upon access to web by the application: C:\Program Files\Mozilla Firefox\firefox.exe.

]]> Comment on TROJAN ALERT! Illredir-B/Illredir-C/Illredir-D by Ceal http://www.zyenweb.com/2010/01/19/trojan-alert-illredir-billredir-cillredir-d/comment-page-1/#comment-263 Ceal Thu, 04 Mar 2010 13:17:06 +0000 http://www.zyenweb.com/?p=114#comment-263 Sent :) Sent :)

]]> Comment on TROJAN ALERT! Illredir-B/Illredir-C/Illredir-D by Mike http://www.zyenweb.com/2010/01/19/trojan-alert-illredir-billredir-cillredir-d/comment-page-1/#comment-262 Mike Mon, 01 Mar 2010 20:23:26 +0000 http://www.zyenweb.com/?p=114#comment-262 Email me your version (code from any forum is already pre-formatted). Zip/Rar the virus with some password and e-mail to the contact email. Include Password :) Thanks ! Email me your version (code from any forum is already pre-formatted).

Zip/Rar the virus with some password and e-mail to the contact email. Include Password :)
Thanks !

]]> Comment on TROJAN ALERT! Illredir-B/Illredir-C/Illredir-D by Ceal http://www.zyenweb.com/2010/01/19/trojan-alert-illredir-billredir-cillredir-d/comment-page-1/#comment-261 Ceal Mon, 01 Mar 2010 14:25:51 +0000 http://www.zyenweb.com/?p=114#comment-261 Thanks Mike for the new version, but it's not working with the code above. Can you help? Thanks Mike for the new version, but it’s not working with the code above. Can you help?

]]> Comment on TROJAN ALERT! Illredir-B/Illredir-C/Illredir-D by Mike http://www.zyenweb.com/2010/01/19/trojan-alert-illredir-billredir-cillredir-d/comment-page-1/#comment-260 Mike Mon, 01 Mar 2010 04:53:08 +0000 http://www.zyenweb.com/?p=114#comment-260 Version 1.0 is out. Should fix most of the latest versions however if you're doing something similar to the virus code your code may be removed too. The script is creating backup copies so if something doesn't work after your run the script keep the script output log and restore from the backups. @Andrew Try to use latest version , also don't chmod 777 the script itself just other files. Some php servers wont run the script with write/execute permissions Version 1.0 is out. Should fix most of the latest versions however if you’re doing something similar to the virus code your code may be removed too. The script is creating backup copies so if something doesn’t work after your run the script keep the script output log and restore from the backups.
@Andrew Try to use latest version , also don’t chmod 777 the script itself just other files. Some php servers wont run the script with write/execute permissions

]]>