Discussion Group hacked

[Jeffrey S. Wexler]

the Discussion Group @ jwsound.net has been hacked today, April 27, 2009, with malicious code invading hundreds of .php files on Lunarpages, the company that hosts that site. We are doing a complete restore from backup which will solve the problem. There is no indication that this code will do anything more than disrupt the functioning of the site with the alarming and annoying warning that appears.

We hope to have everything back to normal by tomorrow.

Thank you for your patience.

Sincerely, Jeff Wexler

NOTE: CinemaSound is not affected by any of this as it is hosted by NING network servers.

[Steve Payne]

My virus scanner (Avast) picked it up. If anyone want's to check their computer then Avast (free ver)will find it.

[Jeffrey S. Wexler]

Avast is PC (Windows only) and the FREE service, web based, will only check one small file at a time. The other problem I am having solving this is that the malware is NOT on my computer (I have done local checks on my Mac) so I can't do anything about it locally. The malware does exist in one or more of the files in the SMF software install on Lunarpages server so I have to get them to do something about it. What you are reporting does appear to be a 2nd attack. There is a distinct possibility that the REPORTING through Google (which has flagged the file) may be in error or it is still reporting something which has been corrected already.

[Steve Payne]

Avast Home edition is Windows only but you can download it. I have it on my computer and it picks up stuff often running in the background. I doubt it would get on your mac anyway.
Avast says it is the following:

http://www.jwsound.net/SMF/index.php?PHPSESSID=82747d836037628a72e6...;\{gzip}
JS:Redirector-H [Trj]
Trojan Horse

I'm sure they will find it.