MODx Forum Infected With Malware

OS: Windows 7
Browser: Firefox 3.6.17
AVG antivirus 9.0.901 (looks for updates daily)

I am in the Netherlands and I did search for the forums on Google first. This was google.nl, mind you. Oddly enough, I have had no problems doing the same thing with Google Chrome (same computer), haven’t tried with Internet Explorer.

Hope this helps.

I’ve been reading some reports lately regarding security issues with Flash. Modern OS’s are pretty secure right now (Windows 7, Mac OS, Linux) so most hackers are making use of security holes in browser plugins to push stuff onto systems. With that in mind, one way to help secure yourself is to either remove Flash or install a plugin that keeps Flash from loading till you tell it to. Granted, this might not protect you from the problems occurring with the forums lately...but it might. Might help if we know more about the hack and how it works.

I got infected too... my anti-virus (Avira) and a run of Malwarebytes
took care of them...

after reading this thread I will run Malwarebytes everyday after visiting
here...

Hey guys, can someone provide us the scan logs of your anti-virus/malware software? There might be a clue in them.

For now I and other team are not able to replicate this after doing a long session of forum surfing in different browsers.

After looking at one page in the MODx forum today (no other sites previously visited):

Hope you can understand German This is the report from Avira’s paid antivir software

Datum/Uhrzeit: 23/06/2011, 16:40:07
In der Datei ’C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira\AntiVir Desktop\TEMP\AVSCAN-20110623-163736-50259D25\AVSCAN-00000002.exe’
wurde ein Virus oder unerwünschtes Programm ’TR/Downloader.Gen’ [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern

Datum/Uhrzeit: 23/06/2011, 16:40:34
In der Datei ’C:\Dokumente und Einstellungen\MYNAME\Lokale Einstellungen\Temp\ms0cfg32.exe’
wurde ein Virus oder unerwünschtes Programm ’TR/Downloader.Gen’ [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern

@ Zi

Some interesting reading:

Original source: http://www.stopbadware.org/reports/95367de0063f3b30d8fec6326671abc5

Report date: Feb 4th 2011
Category: Installed-by visiting
Description:

when visiting the site http://modxcms.com/download with firefox 3.5 and 3.6 (tried 2nd time after updating the system) i’ve got a trojan "spyware protection" automatically installed which killed all other processes.

Found a defender.exe under appdata/roaming and a startup.lnk in start_menu. Name of trojan according to different scanners:

Java/Dldr.Agent.AF
TR/Fake.Rean.200
Win32:FakeSysdef-BH
TR/Agent.hios
Trojan.Win32.Agent.hios
Win32/Adware.SafetyAntiSpyware.A
Mal/FakeAV-EA

Thanks.

Can you replicate it using Google Chrome?

No - don’t have it installed and to be honest, I don’t intend on installing it for Virus / Malware investigation

I’ve now finished the project where I had some problems with, so I won’t be using the forums again for a while.

Hopefully by then this problem will have been resolved.

All i can say to the users of this Forum is: If you have virus or malware problems - PLEASE REPORT THEM.

This is exactly why I always browse using Sandboxie - if any rogue software gets installed through your browser, just close the browser window, delete the sandbox contents, and voila, the threat is gone. With all the nasty stuff out there (and as we can see, even friendly sites can become infected), it’s an excellent layer of defense in case something gets through your firewall and AV programs.

As i fighted the last couple of days with a very ugly trojan called SpyEye (its a big wave rolling through the net, just google "Spyeye Zeus") let me post some links to software to fight back:

General Anti Virus Protection

Avira Free Antivirus
http://www.avira.com/en/avira-free-antivirus

Detect Malware allready on your computer

Malwarebytes Anti-Malware Free
http://www.malwarebytes.org/products/malwarebytes_free

Spyware Doctor
http://www.pctools.com/spyware-doctor/

Spybot S&D
http://www.safer-networking.org/en/index.html


Spybot is a little bit complicated.

And there are a lot of other good detectors. And if you thinbk you are infected its worth running them all, because no tool can detect all malware.

The ultimate weapon to get your system clean: format c: and completly reinstall..

BTW: The infection on my side had nothing to do with modx.com. ive never seen any warnings about malware on modx.com. it also possible that a antivirus just reports a false positive because of setting the heuristic methods to highest level. If you got an infected system, it can be hard to tell what caused that infection.

However, its important to report possible infections, even if there might be nothing at all. And protect yourself.
So yes PLEASE REPORT THEM and PLEASE USE ANTIVIRUS SOFTWARE AT ALL TIMES

And dont just say "i have an apple, no malware". You cann be shure you will be next.