GeekPolice Tech TutorialsLog in

 

Share

descriptionVirus on my websites, HELP!

more_horiz
Hi there!
I've found viruses on two websites I've made. I made them more than 2 yrs ago for my two friends, there was no problem at all so far. I am using a Mac so basically pc viruses can not infect my computer. I downloaded MacScan to scan my machine though, but it showed I'm clean.
The first thing I noticed on the website, that it was a gap on the top of the index page so the whole thing slided down a bit. It was weird for me, so i downloaded and opened index.html with Dreamweaver and I realised a code in html right after the body tag embedded in script tags. I can give a link to the virus code - if i can do that - in rtf file to show you. I'm not sure if i'm allowed to copy and paste it here, so i don't do that.
Both sites are hosted by the same company. I sent a mail to them to ask for help, but they say it's not their responsibility and those viruses infect sites which aren't coded properly... (that helped me a lot, lol.)
So I removed the code, saved and uploaded the index.html, but after 2 days it was there again. Deleted it, uploaded it, but same thing happened, it came back. I've also heard, that these viruses can steal the ftp logon information, that's why they can come back over and over again. I think the hosting company should scan the server for viruses.... I'm not an expert in viruses, so i need help, how to get rid of them. Should i ask for new ftp password? I don't think it would solve it, the problem would come back again.
Thanks in advance!

descriptionRe: Virus on my websites, HELP!

more_horiz
Hello.
May I ask a few questions?

What hosting company are you with? I'm guessing XI web hosting.
What chmod is the .htaccess file set to?
Is the malicious script and iframe?

descriptionRe: Virus on my websites, HELP!

more_horiz
Hi there,

The script is not an iframe. Here is the link for the file of the code in rtf document: http://www.csizmadiaeva.hu/this_affected_my_sites.rtf
I am Hungarian, those sites are at a Hungarian company. There is a chick, who used to update one of the site since I moved from Hungary. Yesterday I emailed the company and I agreed to change the ftp passwords for the sites, and I will be the only one who will use it. Then we'll see if the problem comes back again or not. If not, then the problem went up to the web from that chick's computer. Does it make sense?
Unfortunately I have no idea about the chmod.
Thanks.


Belahzur wrote:
Hello.
May I ask a few questions?

What hosting company are you with? I'm guessing XI web hosting.
What chmod is the .htaccess file set to?
Is the malicious script and iframe?

descriptionRe: Virus on my websites, HELP!

more_horiz
That maybe why.
If you don't know how to use chmod, people can access your files.
See this guide to help you understand:
http://codex.wordpress.org/Changing_File_Permissions

descriptionRe: Virus on my websites, HELP!

more_horiz
Thanks for the link, I neglected these settings, but now I'll pay more attention to proper settings.
BUT: if the virus could steal the ftp logon informations then it is logging in the site with the same credentials as I have as the owner, and in this case it has the same permissions for files as the real owner. Am I right? Should I restrict the login only for a certain IP adress? Actually can I?
Thanks


Belahzur wrote:
That maybe why.
If you don't know how to use chmod, people can access your files.
See this guide to help you understand:
http://codex.wordpress.org/Changing_File_Permissions

descriptionRe: Virus on my websites, HELP!

more_horiz
Not too sure about that, you might be able to being there are a few different versions of cpanel, but I don't run a website, so what do I know? LMBO or ROFL

Now the settings and the FTP password are changed, see if it comes back before we go any further.

descriptionRe: Virus on my websites, HELP!

more_horiz
Thanks for your help
hope the best.

Belahzur wrote:
Not too sure about that, you might be able to being there are a few different versions of cpanel, but I don't run a website, so what do I know? LMBO or ROFL

Now the settings and the FTP password are changed, see if it comes back before we go any further.
Permissions in this forum:
You cannot reply to topics in this forum