They're on different hostings, and on some one of them appears this code.
Is the code the same on every host? Can you give an example of one of the affected domains so we can check that the code exists on the server side and not just on your machine (which would normally be pretty unlikely).
The code you posted is certainly very suspicious. Once decoded, it writes an iframe to http://ecom.rarebreedfootwear.com/? (it tries to add a cachebuster random number to the URL, but fails due to a typo).
There is nothing obviously exploity at that address — perhaps the final target exploit hasn't been put in place yet, or it's just a test run for a real attack later, but an unexpected JavaScript appearing on your site which decodes itself and adds an iframe is a huge red flag. Usually this means your server has been compromised and needs re-installing from scratch with new passwords.
ETA:
you can see it for example at hxxp://flavicius.php5.cz/
Thanks. I deleted the comment to hide the working URL, because it is indeed actually infected. Whether at an application level or Apache itself isn't clear, but every page has the suspect script at the bottom.
So at least the application and conceivably the server is compromised and should be taken off-line for cleaning, reinstallation, and diagnostics: you need to find out how the attackers got in so it doesn't happen again. As a first guess, check you have the latest version of WordPress, as it has suffered many security holes in the past.
It looks like Vundo or a variant of it. That piece of malware has a tendency to insert seemingly meaningless javascript into sites (on your end, not the server-side). I'd suggest trying Malwarebytes' Anti-Malware. Install it, update it, and do a full scan. If that fails, perhaps try researching options for removing Vundo specifically.
发布评论
评论（2）
每个主机上的代码都相同吗？ 您能否给出受影响域之一的示例，以便我们可以检查代码是否存在于服务器端而不仅仅是您的计算机上（这通常不太可能）。
您发布的代码肯定非常可疑。 解码后，它会将一个 iframe 写入 http://ecom.rarebreedfootwear.com/? （它尝试向 URL 添加高速缓存随机数，但由于拼写错误而失败）。
该地址没有任何明显的漏洞利用 - 也许最终的目标漏洞尚未到位，或者它只是稍后进行真正攻击的测试运行，但您的网站上出现了意外的 JavaScript，它会自行解码并添加 iframe是一个巨大的危险信号。 通常这意味着您的服务器已被破坏，需要使用新密码从头开始重新安装。
预计到达时间：
谢谢。 我删除了评论以隐藏工作 URL，因为它确实被感染了。 目前还不清楚是在应用程序级别还是 Apache 本身，但每个页面的底部都有可疑脚本。
因此，至少应用程序和可以想象的服务器受到了损害，应该离线进行清理、重新安装和诊断：您需要找出攻击者是如何进入的，这样就不会再次发生。 首先，请检查您是否拥有最新版本的 WordPress，因为它过去曾遭受过许多安全漏洞。
Is the code the same on every host? Can you give an example of one of the affected domains so we can check that the code exists on the server side and not just on your machine (which would normally be pretty unlikely).
The code you posted is certainly very suspicious. Once decoded, it writes an iframe to http://ecom.rarebreedfootwear.com/? (it tries to add a cachebuster random number to the URL, but fails due to a typo).
There is nothing obviously exploity at that address — perhaps the final target exploit hasn't been put in place yet, or it's just a test run for a real attack later, but an unexpected JavaScript appearing on your site which decodes itself and adds an iframe is a huge red flag. Usually this means your server has been compromised and needs re-installing from scratch with new passwords.
ETA:
Thanks. I deleted the comment to hide the working URL, because it is indeed actually infected. Whether at an application level or Apache itself isn't clear, but every page has the suspect script at the bottom.
So at least the application and conceivably the server is compromised and should be taken off-line for cleaning, reinstallation, and diagnostics: you need to find out how the attackers got in so it doesn't happen again. As a first guess, check you have the latest version of WordPress, as it has suffered many security holes in the past.
它看起来像 Vundo 或其变体。 该恶意软件倾向于将看似无意义的 JavaScript 插入网站（在您端，而不是服务器端）。 我建议尝试 Malwarebytes 的反恶意软件。 安装、更新并进行全面扫描。 如果失败，也许可以尝试研究专门删除 Vundo 的选项。
It looks like Vundo or a variant of it. That piece of malware has a tendency to insert seemingly meaningless javascript into sites (on your end, not the server-side). I'd suggest trying Malwarebytes' Anti-Malware. Install it, update it, and do a full scan. If that fails, perhaps try researching options for removing Vundo specifically.