Another mass compromise

[SysAdMini]

latest url:

ayba[dot]co.uk/j/

[boston]

orangeblue.cl/js/?i=1318356226: final payload is xttp://actris-profit.ru/w.php?f=71&e=2, zeroaccess.
http://jsunpack.jeek.org/dec/go?report=352e61cc9ebd1badd80c3ba1672f35385343c2ba
http://urlquery.net/report.php?id=4855
http://www.virustotal.com/file-scan/report.html?id=21ed0358bbcd763f378d70a72d47e4bdfbc332fad8e52be111d7e4d74ada7bbc-1318358552
http://www.threatexpert.com/report.aspx?md5=38b353ec257c71d19f976f06f0510eaf

[boston]

update:
xttp://89.208.34.80/w.php?f=71&e=2
http://www.virustotal.com/file-scan/report.html?id=c74b19c89b055feecbff2d7c6f42871d6f01046143339e7e9d731679eb3d8d92-1318418905

[Kimberly]

some numbers and facts to this oscommerce hack:

these domains are infected (3679).
i estimate perhaps i got them all via exhaustive google search.... but maybe only 90% ... who knows  

Code: [Select]

stopmalvertising.com


There's a difference between writing an article and being infected, get your research straight. Do you actually ever read what you are posting btw?

[Kimberly]

Had another quick look at that list .... armorize.com, computerworld.com.au, dslreports.com ... Google Search is cool but the results need to be verified before posting them in public. I hate to think that a list like this one is submitted to Google Safebrowsing or similar services without any form of verification.