[SOLVED] Malware spread from this site

[MichaKL]

Hello,

There seems to be some problem with certain content here which results in 'infection' of unprotected Windows boxes.
"www/delivery/ajs.php" keeps popping up in my security software. Besides that, Rogue security software got installed on my 'firebox' from visiting here. Apparently the payload is downloaded from randombroken.ipq.co, which is triggered by the aforementioned *.php.
This probably should be investigated as soon as possible. Thanks much in advance.

Cheers,
Micha

[MichaKL]

i.imgur.com/xTEPc.png

[oz]

Hello and welcome to the forums!

I've forwarded a report of this to those in charge of that part of the website.

Thanks for the alert and feedback.

[oz]

Okay, I just got word back that this matter is currently under investigation.

Thanks again for the feedback.

[MichaKL]

Okay, I just got word back that this matter is currently under investigation.

Hello,

Thanks much for the speedy reaction!
The issue currently appears to be fixed.
Maybe it would be helpful for your users to get some more details of the problem, i.e. timestamps of from when to when the problem existed. I'd guess that quite a bunch of (Win-) visitors may not know what hit them.
Thanks much again for handling this matter.

Cheers and greetings from Japan.

Micha
[KL]

[MichaKL]

Hello,

The issue currently appears to be fixed.

Sadly, the issue is back!
As of currently (Wed Apr 20 07:59:03 UTC) malicious code is pushed again.
Windows users accessing any page here with unprotected PC will get infected with Rogue security software.
Please kindly have this investigated ASAP.

Cheers,
Micha
[KL]

*Edit: Correction, now the payload is 'Backdoor.Win32.Agent.bhve' and not a RogueAV

[MichaKL]

i.imgur.com/yAzb3.png

[oz]

I've not gotten any further updates on the matter from those investigating it but will post back when I hear something more.

Thanks for the feedback.

[MichaKL]

I've not gotten any further updates on the matter from those investigating it but will post back when I hear something more.

Hello,

Thank you for checking on it.
Hopefully the people in charge are aware of how serious this problem is. This server really should be taken offline and investigated/fixed properly before having it back on the net.
Thank you.

Cheers,
Micha
[KL]

[oz]

Hello Micha

I've received a report that this issue has now been fixed. Unfortunately, no other details came with the report. Are you able to verify that it is, or is not, fixed on your end?

Thank you.