mysql.com hacked to serve malware: video report to accompany blog post

[Daniel15au]

2:06 Malware "permanently installed"? No, lol. It's not permanent. You can get rid of it.

[dogmatch100]

ИНФОРМАЦИЮ О ДОГОВОРНЫХ МАТЧАХ КУПИТЬ МОЖНО ЗДЕСЬ dogmatch.3dn.ru/

[ifnotxtheny]

Так умер Гуф 80 лвл.

[vchkogpu]

Please translate me in Russian what the man said on the site total virus?

[adictodigital]

Hello!!!

Please Release: File Monitor Software For Home Users!!!

Thank you so much!!!

[WebMasterGadgets]

Damn. Your using Windows! O.o and then XP o.O

[mykill1221]

@WebMasterGadgets He's using an virtual machine.

[r3alw0rld]

@WebMasterGadgets XP ( professional ) is the best OS from microsoft.. Vista and Win 7 is just crap! ;)

[PoyTep]

I have brother mysql died from

[Boozle061083]

Can't believe that root access to mysql.com was sold on russian hacker forums for just $3k which lead to this

[viner922]

well done dude

[TheAffemitWaffe]

what am i look at?! :D

[SMTyou]

What typ of Trojan or Worm... w/e, is it exacly ?

[mykill1221]

@SMTyou It's something that locks your PC. It want 100 Euro for unlock it again

[SMTyou]

@mykill1221 Lmfao

[mykill1221]

@SMTyou Is that really funny?!

[SMTyou]

@mykill1221 Actually, yes. I never heard of that typ of trojan. Even though it's bad or not funny, you could simply reinstall your computer.

[vorhaut23]

i dont get what happend 

[SkitchThat]

@vorhaut23 Basically a hacker injected a javascript (HTML friendly programming language) redirect to a different website, which prompted java to run, load and save an executable file to the local computer. Therefore infecting it with a virus, trojan or whatever the byte code contained. Pretty simple.

[LeiErebus]

Why does he always mention his secret account ?

[carlosrevillah]

Muy buena la explicación.



[JaapBeetstra]

The Antivirus solutions that identified it are: ByteHero, ClamAV, Kaspersky, Rising, TrendMicro and TrendMicro-HouseCall. ClamAV and TrendMicro-HouseCall seem to have free versions available.

[drunkennewfiemidget]

Thanks for the video.

Now stop fucking pronouncing 'sql' as 'sequel'.

[stonerscolony]

@drunkennewfiemidget I had to work for years with the "sequel" speaking peoples lol. Took me a little while especially late at night to figure they wanted to DB work done lol... as noted it's SQL! higher upper-case acronym not a word itself!

[Warkive]

@drunkennewfiemidget And why not? People rarely say, "N A S A", they say NASA as one word.  Why does this offend you so? I swear, white people problems.

[hoboX10]

@drunkennewfiemidget That's actually its intended pronunciation.

[drunkennewfiemidget]

@hoboX10 No, it isn't. SQL was what it was renamed to FROM sequel.

[ChieftainY2k]

That is why you should ALWAYS use your browser in secure sandboxed environment (I suggest sandboxie, google it up :) )

[MatejTomcik]

Please, let us know if you find a way how to get rid of that virus or where is it hidding...

[DrSupahFly]

@MatejTomcik just reformat? if not.. look in msconfig, startup directory, or scheduled tasks.

[MatejTomcik]

@DrSupahFly Those were the first things that came to my mind. I've scanned my PC both with Microsoft Security Essentials and Kaspersky in safe mode, they found nothing. I also scanned WIN and TEMP directory for the files which matches the MD5 hashes with those in the video, nothing. And I can't "just reformat"...

[DrSupahFly]

@MatejTomcik then you must have not been vulnerable to any of those exploits. sure you can just reformat. you can just keep everything in a new partition (your current installation will be moved to that) and re-install. are you sure you're even infected?

[MatejTomcik]

@DrSupahFly No I'm not sure, I can't find it, that doesn't meen I'm not infected. I was on dev.mysql.com that day and Google warned me about malware, but I was like "mysql . com? malware? nooo...". It seems like I have underestimated hackers and their sneaky ways... Does anyone know what does that virus do?

[lVl477H13Ll]

Good video, well done. :)

[Thorndepth]

nice work, very intellectual!

[xiaoshiqi]

不是我干的(╯▽╰)

[Stasoline]

Thanks for showing the tools in use!

[TartaroZ]

nicely done

[Yessj]

Very nice work!