Dave Blair from AEA 14 has been giving me most of it. All of my Moodle servers are effected, and his as well.
There is no outward appearance of a problem. If you do have a moodle server I would recommend that you check your page source of any page and look to see if you have about 50 links <a href =...> with terms such as blue pill in the URL. You want to see what it looks like go to 207.28.111.100/moodle and check the page source on that page. Several PHP files were changed, but according to Dave, he has had difficulty removing the problem. Each file does seem to have a new encrypted line and I expect that is how the exploit works. My guess is it is an attempt to bring a site ranking up in Google and other search engines. -------------------------------------------------- From: "Frerichs, Chad" <cfreri...@okoboji.k12.ia.us> Sent: Monday, February 23, 2009 4:12 PM To: <info-tech@aea8.k12.ia.us> Subject: RE: [info-tech] Moodle Site | Scott, | | Where are you getting your information? | | Chad Frerichs | Director Of Technology | Okoboji Community Schools | Milford, IA 51351 | | -----Original Message----- | From: Scott Fosseen [mailto:sfoss...@aea8.k12.ia.us] | Sent: February 23, 2009 3:53 PM | To: info-tech@aea8.k12.ia.us | Subject: Re: [info-tech] Moodle Site | | | I need to let everyone know that there has been a major explode of | Moodle. | A lot of sites have been compromised and admins are scrambling to fix. | As | near as I can tell the easiest way to correct is a complete site reload, | so | it is possible that you will see issues with any Moodle server you visit | or | use the next few weeks. | | This particular exploit has even the moodle experts are baffled. | | | From: Koenck, Chris | Sent: Monday, February 23, 2009 2:49 PM | To: info-tech@aea8.k12.ia.us | Subject: [info-tech] Moodle Site | | | Can someone out there check and see what they get when you open the | following link to AEA 11 moodle? I am not familiar with what this is | exactly, but is Heartland AEA Moodle. We need to get to it for | continuing | education. Thanks for your help. | | http://moodle.aea11.k12.ia.us/moodle/ | | | Chris Koenck | Network Specialist | Head Wrestling & Boys' Tennis Coach | Estherville Lincoln Central CSD | 712-362-8404-office | 712-380-2337-cell | | | | --- | [This E-mail scanned for viruses by Declude Virus on the server | aea8.k12.ia.us] | | --------------------------------------------------------- | Archived messages from this list can be found at: | http://www.mail-archive.com/info-tech@aea8.k12.ia.us/ | --------------------------------------------------------- | --- | [This E-mail scanned for viruses by Declude Virus on the server aea8.k12.ia.us] | | --------------------------------------------------------- | Archived messages from this list can be found at: | http://www.mail-archive.com/info-tech@aea8.k12.ia.us/ | --------------------------------------------------------- | --- [This E-mail scanned for viruses by Declude Virus on the server aea8.k12.ia.us] --------------------------------------------------------- Archived messages from this list can be found at: http://www.mail-archive.com/info-tech@aea8.k12.ia.us/ ---------------------------------------------------------
