Hi.
I met a problem with redirects instead of normal web-site. Later I figured out that the killing nmbd process stops malicious redirects.
History of the problem.
A Ukrainian web-site pravda.com.ua
This is how it has to look and looks for all the users:
http://static.xscreenshot.com/small/2012/06/13/14/screen_13a31999104e1e9cf27cd15270dccdae](http://view.xscreenshot.com/13a31999104e1e9cf27cd15270dccdae)
But after some surfing I’m redirected to a page like this (in all browsers)
http://static.xscreenshot.com/small/2012/06/12/14/screen_363742b654f0751dc0831c226fe2e126](http://view.xscreenshot.com/363742b654f0751dc0831c226fe2e126)
The HTML of the page is self-explaining. Something malicious.
<frameset rows="100%,*" frameborder="no" border="0" framespacing="0">
<frame src="http://www.pravda.com.ua/?fp=jtkF%2B1mc76IGQ7NK5ZqBtwIT8MEIzaODgeaIrD5RFOu%2BJx6RgjOxT%2FxAGW5Ea9cB%2BPKuFvNuHeOcR%2B0ap%2FVD3g%3D%3D&prvtof=fiFDNUzkbi%2BzOQuDQA8MmNLHJD82S4MdAY%2FzIyzZRUQ%3D&poru=PHuFPeyrOO9Smv6uk7v5SS5Cg4u4Bx9sRhXjev6ydafXHClPVvTtq0MiqkfzHnee&">
</frameset>
<noframes>
<body bgcolor="#ffffff" text="#000000">
<script type="text/javascript"><!--
var _gaq = _gaq || ];
_gaq.push(
'_setAccount', 'UA-7519982-1'],
'_trackPageview']
);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
//-->
</script>
<script type="text/javascript"><!--
var _gaq = _gaq || ];
_gaq.push(
'_setAccount', 'UA-7519982-1'],
'_trackPageview']
);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
//-->
</script>
<a onclick="_gaq.push('_trackEvent', 'Outgoing', 'www.pravda.com.ua', '/?fp=jtkF%2B1mc76IGQ7NK5ZqBtwIT8MEIzaODgeaIrD5RFOu%2BJx6RgjOxT%2FxAGW5Ea9cB%2BPKuFvNuHeOcR%2B0ap%2FVD3g%3D%3D&prvtof=1nrUlG5zXftPohBp1dC698racgtLfxQNsPbsiKN9GyY%3D&poru=4qcaoyn4X%2FOreoV7xUtwQnI8qDd3a8XMTHea9yrqtZkxkVoLlT0qvlI75OeiPUhd&']);_gaq.push('_trackEvent', 'Outgoing', 'www.pravda.com.ua', '/?fp=jtkF%2B1mc76IGQ7NK5ZqBtwIT8MEIzaODgeaIrD5RFOu%2BJx6RgjOxT%2FxAGW5Ea9cB%2BPKuFvNuHeOcR%2B0ap%2FVD3g%3D%3D&prvtof=1nrUlG5zXftPohBp1dC698racgtLfxQNsPbsiKN9GyY%3D&poru=4qcaoyn4X%2FOreoV7xUtwQnI8qDd3a8XMTHea9yrqtZkxkVoLlT0qvlI75OeiPUhd&']);" href="http://www.pravda.com.ua/?fp=jtkF%2B1mc76IGQ7NK5ZqBtwIT8MEIzaODgeaIrD5RFOu%2BJx6RgjOxT%2FxAGW5Ea9cB%2BPKuFvNuHeOcR%2B0ap%2FVD3g%3D%3D&prvtof=1nrUlG5zXftPohBp1dC698racgtLfxQNsPbsiKN9GyY%3D&poru=4qcaoyn4X%2FOreoV7xUtwQnI8qDd3a8XMTHea9yrqtZkxkVoLlT0qvlI75OeiPUhd&">Click here to proceed</a>.
</body>
</noframes>
And get a popup with a youtube video (addidas stella maccartney advertising with a too thin girl). Note, the сonstitution of the girl doesn’t matter, I speak only of the technical problem. (-:
The web-site looks in lynx like this when reidrected:
FRAME:
http://www.pravda.com.ua/?fp=T9QKBDETz7Q6Rbg55kYk1Aj
hS5ZyhA0gnmYEYf55FMSAvvrhp8ReWT92eG%2F5JDXPeq3NQ1HxY
pkEhgWMu1HEhg%3D%3D&prvtof=xNVtsw7Gxhxp2mfwakh2%2BV2
aP1gEYt1fCxDO9Nwx8Yg%3D&poru=fRlio8iNmcRbhfSmSq7sEFI
kqCrv3Lay2qqKwxMAMFo9hTfh5b%2FOGtZEdBYpZNTy&
Click here to proceed.
I got a anothe problem with another web-site, which is partially close to this problem.
radion.com.ua
This is how it has too look:
http://static.xscreenshot.com/small/2012/06/12/14/screen_0cdafd2b042072b59526af071467dd0d](http://view.xscreenshot.com/0cdafd2b042072b59526af071467dd0d)
With nmbd enabled FF gives an empty page, and Konqueror loads it partially:
http://static.xscreenshot.com/small/2012/06/12/14/screen_d6071a31f2c56f346f10c5c9c4db17e7](http://view.xscreenshot.com/d6071a31f2c56f346f10c5c9c4db17e7)
As you can see, images are broken. I tried to open an image directly
http://www.radion.com.ua/components/com_virtuemart/shop_image/category/resized/_________________4fc1f1769d9cf_124x124.png
and was redirected to a false link
http://www.radion.com.ua/?f
(it’s partially-working malicious code)
I digged out much ground, requested help form the Ukrainian community. We traceroted, digged, looked at many files like /etc/hosts and /etc/resolv.conf and so on. Only the killing processes one by one gave the result. I believe it’s a virus. Another machine in the LAN which uses Lubuntu doesn’t meet any problems. Now the nmbd service is stopped and killed. I meet no problems. But I believe this must be investigated by a professional user. That’s why I don’t remove/reinstall nmbd and so on.
Additional info:
- the problem is for all users, including root
- the web-sites open well and as expected via TOR and OperaTurbo
- clamav doesn’t see any problem
- OpenSuse 12.1
I need your assistance! I’m ready to give an ssh access to a specialist.
Thanks in advance.