Virus on my websites, HELP!

View previous topic View next topic Go down

Virus on my websites, HELP!

Post by piazzadoro on Tue Feb 24, 2009 6:27 am

Hi there!
I've found viruses on two websites I've made. I made them more than 2 yrs ago for my two friends, there was no problem at all so far. I am using a Mac so basically pc viruses can not infect my computer. I downloaded MacScan to scan my machine though, but it showed I'm clean.
The first thing I noticed on the website, that it was a gap on the top of the index page so the whole thing slided down a bit. It was weird for me, so i downloaded and opened index.html with Dreamweaver and I realised a code in html right after the body tag embedded in script tags. I can give a link to the virus code - if i can do that - in rtf file to show you. I'm not sure if i'm allowed to copy and paste it here, so i don't do that.
Both sites are hosted by the same company. I sent a mail to them to ask for help, but they say it's not their responsibility and those viruses infect sites which aren't coded properly... (that helped me a lot, lol.)
So I removed the code, saved and uploaded the index.html, but after 2 days it was there again. Deleted it, uploaded it, but same thing happened, it came back. I've also heard, that these viruses can steal the ftp logon information, that's why they can come back over and over again. I think the hosting company should scan the server for viruses.... I'm not an expert in viruses, so i need help, how to get rid of them. Should i ask for new ftp password? I don't think it would solve it, the problem would come back again.
Thanks in advance!

piazzadoro
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-02-24
OS OS : Mac OSX 10.4.11.
Points Points : 28433
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Virus on my websites, HELP!

Post by Belahzur on Tue Feb 24, 2009 5:18 pm

Hello.
May I ask a few questions?

What hosting company are you with? I'm guessing XI web hosting.
What chmod is the .htaccess file set to?
Is the malicious script and iframe?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Virus on my websites, HELP!

Post by piazzadoro on Wed Feb 25, 2009 2:31 am

Hi there,

The script is not an iframe. Here is the link for the file of the code in rtf document: [You must be registered and logged in to see this link.]
I am Hungarian, those sites are at a Hungarian company. There is a chick, who used to update one of the site since I moved from Hungary. Yesterday I emailed the company and I agreed to change the ftp passwords for the sites, and I will be the only one who will use it. Then we'll see if the problem comes back again or not. If not, then the problem went up to the web from that chick's computer. Does it make sense?
Unfortunately I have no idea about the chmod.
Thanks.


[You must be registered and logged in to see this link.] wrote:Hello.
May I ask a few questions?

What hosting company are you with? I'm guessing XI web hosting.
What chmod is the .htaccess file set to?
Is the malicious script and iframe?

piazzadoro
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-02-24
OS OS : Mac OSX 10.4.11.
Points Points : 28433
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Virus on my websites, HELP!

Post by Belahzur on Wed Feb 25, 2009 3:14 pm

That maybe why.
If you don't know how to use chmod, people can access your files.
See this guide to help you understand:
[You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Virus on my websites, HELP!

Post by piazzadoro on Thu Feb 26, 2009 1:47 am

Thanks for the link, I neglected these settings, but now I'll pay more attention to proper settings.
BUT: if the virus could steal the ftp logon informations then it is logging in the site with the same credentials as I have as the owner, and in this case it has the same permissions for files as the real owner. Am I right? Should I restrict the login only for a certain IP adress? Actually can I?
Thanks


[You must be registered and logged in to see this link.] wrote:That maybe why.
If you don't know how to use chmod, people can access your files.
See this guide to help you understand:
[You must be registered and logged in to see this link.]

piazzadoro
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-02-24
OS OS : Mac OSX 10.4.11.
Points Points : 28433
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Virus on my websites, HELP!

Post by Belahzur on Thu Feb 26, 2009 9:31 am

Not too sure about that, you might be able to being there are a few different versions of cpanel, but I don't run a website, so what do I know? LMBO or ROFL

Now the settings and the FTP password are changed, see if it comes back before we go any further.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Virus on my websites, HELP!

Post by piazzadoro on Fri Feb 27, 2009 12:52 am

Thanks for your help
hope the best.

[You must be registered and logged in to see this link.] wrote:Not too sure about that, you might be able to being there are a few different versions of cpanel, but I don't run a website, so what do I know? LMBO or ROFL

Now the settings and the FTP password are changed, see if it comes back before we go any further.

piazzadoro
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-02-24
OS OS : Mac OSX 10.4.11.
Points Points : 28433
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum