Description: Encoded javascript malware to load the "Fake AV" virus from
multiple domains.
Affecting: WordPress-based web sites.
Clean up: Malware is hidden at the header.php inside the themes directory.
Malware dump:
SiteCheck Signatures
- malware.redkit
- malware.oscommerce_infection
- malware.nuclear
- malware.mobile
- malware.reversed_pastebin
- malware.reverse_script
- malware.rks_injection.1
- malware.rks_injection
- malware.rig_ek
- malware.magento_shoplift.38.2
- malware.magento_shoplift.38.1
- malware.injection
- malware.iis_injection
- malware.iframe_src
- malware.injection.27
- malware.js_type_obfuscation
- malware.magento_shoplift
- malware.magento_redirect.1
- malware.magento_redirect
- malware.rks_injection.2
- malware.rks_injection.3
- malware.visitor_tracker
- malware.vb_dropper
- malware.tor_ff_exploit
- mw-cookie-blacklisted
- mw-exploitkitredkit1
- mw-iframe-suspiciousport
- mw-iframe-fakejquery
- mw-fakeav2012
- malware.tds_url
- malware.sweetorange_ek
- malware.scounter
- malware.runforest
- malware.rks_injection.4
- malware.script_base64
- malware.script_scr
- malware.sql_injection
- malware.short_url
- malware.shorte_st_injection
- malware.iframe_injection
- malware.hidden_iframe
- malware-entry-mwwp135
- malware-entry-mwspamseo
- malware-entry-mwspams8
- malware-entry-mwspams2
- malware-injection-jtoolsmini-js
- malware.applet
- malware.cryptominer
- malware.blackhole_ek
- malware.atob_fcc
- malware-entry-mwspamph23
- malware-entry-mwspamp0
- backdoor-phpbot-sql2
- malware-entry-mwmrobh3
- malware-entry-mwmrobh2
- malware-entry-mwrks2
- malware-entry-mwrks3
- malware-entry-mwsipro1
- malware-entry-mwrks5
- malware-entry-mwrks4
- malware.cryptominer.1
- malware.cryptominer.10
- malware.fcc_obfuscation
- malware.encrypted_iframe_injection
- malware.embed
- malware.forum_redirect
- malware.forum_redirect.1
- malware.hex_reverse_script
- malware.generic_jsobfuscator
- malware.generic
- malware.darkleech
- malware.cryptominer.9
- malware.cryptominer.3
- malware.cryptominer.2
- malware.cryptominer.11
- malware.cryptominer.4
- malware.cryptominer.5
- malware.cryptominer.8
- malware.cryptominer.7
- malware.cryptominer.6
- mw-javascript-check2
- mw-redir-fakeav533
- spam-seo.dating_spam.1
- spam-seo.dating_spam
- spam-seo-suspicious15
- spam-seo-suspicious14
- spam-seo.escort_spam
- spam-seo.exam_spam
- spam-seo.hidden_content.80
- spam-seo.hidden_content.70
- spam-seo.hidden_content
- spam-seo-injected13
- spam-seo
- redirect.refresh
- redirect.parked
- redirect.dec_ip.1
- rogueads
- rogueads.afu
- rogueads.unwanted_ads
- rogueads.cookieconsent.1
- rogueads.cookieconsent
- spam-seo.linking_anomaly
- spam-seo.link_masking
- warning.db_error
- warning.500_internal_error
- warning.403forbidden
- warning-400
- warning-empty
- warning-empty-search
- warning-restricted-access
- warning.html_anomaly
- warning.maintenance
- web-site-disabled
- warning.suspended
- warning.script_error
- warning-connection
- warning-tls
- warning-redirect
- warning
- spam-seo.script_redirect
- spam-seo.sape
- spam-seo.porn_keywords
- spam-seo.spammy_keywords
- spam-seo.spammy_post
- spam-seo.view_state
- spam-seo.suspicious_url
- spam-seo.spammy_post.1
- redirect.dec_ip
- redirect
- mwjs-iframe-document-write
- mwjs-evalunesc-wscripts
- mwjs-encoded-text-enhance
- mwjs-encoded-spam1
- mwjs-iframe-hidden-push2
- mwjs-iframe-hidden1
- mwjs-iframe-injected515
- mwjs-iframe-injected509
- mwjs-iframe-injected501
- mwjs-encoded-myobfuscator
- mwjs-encoded-hex1
- mwdocumentwrite-encoded17
- mw.js.iframer1
- mw-redirection121
- mwjs-applet-inject35
- mwjs-enciframe-injected507
- mwjs-encoded-generic1
- mwjs-encoded-dadong1
- mwjs-encoded-cloudfront1
- mwjs-iframe-injected516
- mwjs-iframe-injected530
- mwjsinjectmls
- mwjs-pluggable1
- mwjs-packer-runforest3
- phishing-phis02
- php-error-error-establishing-a-database-connection
- php-error-headers-already-sent
- php-error-fatal-error
- php-error-eval-code-errors
- mwjs-include-unescape3
- mwjs-include-suspicious2
- mwjs-include-document-write
- mwjs-include-bitly
- mwjs-iframe-injected691
- mwjs-include-images
- mwjs-include-pastebin
- mwjs-include-suspicious
- mwjs-include-rebots
- mwjs-include-pmg
- malware-entry-mwmrobh1
- malware-entry-mwoscom1
- malware-entry-mwiframehd21
- malware-entry-mwiframehd207
- malware-entry-mwiframehd203
- malware-entry-mwiframehd202
- malware-entry-mwiframehd22
- malware-entry-mwiframehd2298
- malware-entry-mwiframehd3
- malware-entry-mwiframehd28
- malware-entry-mwiframehd23
- malware-entry-mwiframehd20
- malware-entry-mwiframehd187
- malware-entry-mwiframeenc1560
- malware-entry-mwiframeeiue
- malware-entry-mwhta9
- malware-entry-mwiframeenc1603
- malware-entry-mwiframeenc8712
- malware-entry-mwiframehd14
- malware-entry-mwiframehd13
- malware-entry-mwiframegcounter
- malware-entry-mwiframehd301
- malware-entry-mwiframehd31
- malware-entry-mwiframehd55
- malware-entry-mwiframehd54
- malware-entry-mwiframehd5
- malware-entry-mwiframehd499
- malware-entry-mwiframehd564
- malware-entry-mwiframehd567
- malware-entry-mwjsyadr0
- malware-entry-mwiframehd700
- malware-entry-mwiframehd572
- malware-entry-mwiframehd476
- malware-entry-mwiframehd473
- malware-entry-mwiframehd37
- malware-entry-mwiframehd36
- malware-entry-mwiframehd321
- malware-entry-mwiframehd371
- malware-entry-mwiframehd39
- malware-entry-mwiframehd438
- malware-entry-mwiframehd429
- malware-entry-mwiframehd421
- malware-entry-mwhta7
- malware-entry-mwhta4
- malware-entry-hiddeniframedocument-write
- malware-entry-g-oogl-e-com
- malware-entry-dwfcc-co-cc
- malware
- malware-entry-mwanomalysp7
- malware-entry-mwanomalysp8
- malware-entry-mwback451
- malware-entry-mwb6421
- malware-entry-mwapplethd522
- defacement.generic
- defacement
- backdoor-phpfilesman02
- backdoor-phpevalgzinflateb64
- backdoor-phpc99045
- backdoor-phpgeneric07
- backdoor-phpmailer33
- backdoor-phpwebshell03
- backdoor-phpr5701
- backdoor-phppreg_replaceeval
- malware-entry-mwbackdoor23
- malware-entry-mwblacklisted35
- malware-entry-mwhighclass1
- malware-entry-mwgrepadd2
- malware-entry-mwgdd6
- malware-entry-mwgdd5
- malware-entry-mwhjck3123
- malware-entry-mwht291
- malware-entry-mwhta3
- malware-entry-mwhta13
- malware-entry-mwht292
- malware-entry-mwgdd4
- malware-entry-mwgdd3
- malware-entry-mwblueh2
- malware-entry-mwblueh1
- malware-entry-mwblk2
- malware-entry-mwdarkleech3
- malware-entry-mwdefaced01
- malware-entry-mwfree4025
- malware-entry-mwexploitkitblackhole2
- malware-entry-mwexploitkitblackhole1
- malware-entry-mwiframetiocp
- malware-entry-mwiframehd765
- malware-entry-mwjs612
- malware-entry-mwjs611
- malware-entry-mwjs537
- malware-entry-mwjs519
- malware-entry-mwjs613
- malware-entry-mwjs616
- malware-entry-mwjs6525
- malware-entry-mwjs62313
- malware-entry-mwjs62312
- malware-entry-mwjs518
- malware-entry-mwjs517
- malware-entry-mwjs445
- malware-entry-mwiis3
- malware-entry-mwjs442
- malware-entry-mwjs455
- malware-entry-mwjs456
- malware-entry-mwjs512
- malware-entry-mwjs488
- malware-entry-mwjs457
- malware-entry-mwjs66
- malware-entry-mwjs67473
- malware-entry-mwjsiframe781
- malware-entry-mwjsiframe213
- malware-entry-mwjsfrag1
- malware-entry-mwjsexp753
- malware-entry-mwjsjj677
- malware-entry-mwjsjj678
- malware-entry-mwjsosc866
- malware-entry-mwjsmainnet
- malware-entry-mwjskdjk
- malware-entry-mwjsdepack
- malware-entry-mwjsde921
- malware-entry-mwjs751
- malware-entry-mwjs711
- malware-entry-mwjs69693
- malware-entry-mwjs789
- malware-entry-mwjs791
- malware-entry-mwjsanon7
- malware-entry-mwjs817
- malware-entry-mwjs792
- malware-entry-mwjs4359
- malware-entry-mwjs443
- malware-entry-mwjs199
- malware-entry-mwjs160
- malware-entry-mwjs159
- malware-entry-mwjs153
- malware-entry-mwjs203
- malware-entry-mwjs205
- malware-entry-mwjs221
- malware-entry-mwjs4351
- malware-entry-mwjs207
- malware-entry-mwjs152
- malware-entry-mwjs151
- malware-entry-mwjs1211
- malware-entry-mwiopap1
- malware-entry-mwiis4
- malware-entry-mwjs1240
- malware-entry-mwjs1241
- malware-entry-mwjs150
- malware-entry-mwjs1306
- malware-entry-mwjs1304
- malware-entry-mwjs222
- malware-entry-mwjs2106
- malware-entry-mwjs2370
- malware-entry-mwjs2369
- malware-entry-mwjs223
- malware-entry-mwjs245
- malware-entry-mwjs3029
- malware-entry-mwjs3022
- malware-entry-mwjs3023
- malware-entry-mwjs2368
- malware-entry-mwjs431
- malware-entry-mwjs2299
- malware-entry-mwjs229
- malware-entry-mwjs2367
- malware-entry-mwjs233
- malware-entry-mwjs235
- mwjs-encoded-badinjected1
- malware-entry-mwjs444
- malware-entry-mwjsgen2
- mwjs-iframe-document-write3
- malware.encrypted_iframe_injection.3
- malware.injection.32
- malware.injection.41
- malware.script_src
- redirect.meta_refresh
- spam-seo.hidden_content.81
- Home
- SiteCheck Signatures
- malware-entry-mwjs233