Eplarine Malware

Updated: June 4, 2010

The Eplarine malware places obfuscated malicious JavaScript into a website's web pages . To clean the website, the website needs to be reverted to a clean backup or the malicious code needs to be removed from the web pages. The malware gains access to the website through FTP credentials that have been compromised by malware located on a computer that has accessed the website via FTP. To prevent the website from being reinfected the FTP password needs to be changed and the malware removed from the infected computer before it used again to access the website via FTP.

Recent Script Format On Web Pages:

Recent Domains Used by the Malware: eplarine.com, eguyendu.com, dacenete.com, paleenem.com, reglasti.com, scornar.com

Recent Virus Scan Identifications: HTML:IFrame-LL, HTML:IFrame-LZ, Mal/ObfJS-CB, Troj/Iframe-DP