Is Aminet OK/infected?

[Dr.Bongo]

Amibay is re-directing to a spam page now

[Piru]

My best guess at present is that it's a variant of this:-

BlackHole Exploit Kit

Yes it is. But this has nothing to do with the actual vulnerability that was used to pwn it. This is just the tool they use to infect victims browsing the site. (In my earlier post, this is the step 2. How the step 1 was achieved remains unclear.)

Any attempts to remove the malware links are in vain until the actual root cause for the site exploit has been identified and fixed.

[WotTheFook]

@ Piru

All Admins are currently changing their passwords and checking local machines are clear of infection before we attempt to repair the server.

@ All

If you Google AmiBay and select any link EXCEPT the home page, you should get on. This link should also work.

http://www.amibay.com/search.php?do=getnew

[Dr.Bongo]

@ WotTheFook - Thank you

[Virge]

Hi.

Sometimes i can enter on Aminet others Not same with Amibay

Regards
Pedro

[WotTheFook]

Normal service should have been restored on the Amibay home page now.

[golem]

Still getting trojan here

[WotTheFook]

We identified php/Kryptik.AB trojan in a file called php_engine9181.php this evening. We have removed the infected file and restored the index.php file as before.

Now we know what we are up against....

WotTheFook aka Merlin

[Piru]

We identified php/Kryptik.AB trojan in a file called php_engine9181.php this evening. We have removed the infected file and restored the index.php file as before.

Did you also identify how the trojan got there? That's the important question.

[WotTheFook]

We believe that an Admin account was compromised. After ensuring all of the Admin local machines were clean and clear of infection, the Admins changed their passwords and it was then that we set to work to clean the site.

Useful information for the Admins on A.org
----------------------------------------
The infected file was in the admincp folder on the server and had edited the index.php file with some encrypted script. Once we had identified the infection and cleared it, we were able to fix the index.php file and the site has remained stable from then until now.

If this attack happens to you at some point, this information should help you.