I decided to check first twenty Sulumits Retsambew entries for which CMS they use.
1. sulumitsretsambew.org – wordpress
2. sulumitsretsambew.biz – joomla
3. sulumitsretsambewno.com – wordpress
4. sulumitsretsambew.com – static page
5. webmasterstimulus.org – wordpress
6. mygulfcoastbeachteam.com/sulumits-retsambew/ – wordpress
7. slideshare.net/guestce90ce/sulumits-retsambew – web 2.0
8. pedeee.com – wordpress
9. sulumits—retsambew.blogspot.com – blogger
10. tadkashadka.com – wordpress (more…)
I found that lot of people sites (joomla, wordpress, smf forum, static ones) get infected with these versions of iframe viruses too. Probably they are same variants of goooogleadsence.biz, cutlot.cn, google-ana1yticz.com, mixante.cn worms. You can read my problems with this worms in one of my previous posts, also there is bunch of useful comments there… My server antivirus detects them all as exploit.html.iframe-6. As it is known these viruses infect your pc, and take ftp password from your ftp programs like filezilla and then infect every index file on you server that you have right to write.
Steps to clean this pest are to download latest antivirus software and clean your pc. NOD32 2.7 with latest definitions or Avast free will clean this worms from your pc. Then change all cpanel and user accounts passwords. After that, bring your clean backup of public html files. If your site is too big for bringing backup files there is removal tool you can download it here: iframe worms removal tool.
Thanks to Dragos for this. He left it in my comment for previous thread about this pest.
Be careful by using this script. I destroyed all my .php and .html files with it on one of my sites. First download your site offline and try this on some standalone php mysql apache server (wamp, lamp, jsas). Also your antivirus will maybe detect this file as a virus since it contain line bellow with the instruction which virus it needs to remove.
iframe worm removal tool
(more…)
