+ Post New Thread
Results 1 to 7 of 7
Web Development Thread, Website Virus in Coding and Web Development; Hello, I designed and maintain a website for a local guest house. The host is student web hosting. I seem ...
  1. #1

    Join Date
    Apr 2007
    Location
    York
    Posts
    548
    Thank Post
    8
    Thanked 4 Times in 4 Posts
    Rep Power
    19

    Website Virus

    Hello,
    I designed and maintain a website for a local guest house. The host is student web hosting. I seem to constantly be getting a virus on the site, at least 3 times a week. I don't have any php or scripts running so it can't be an exploit of that. It seems to create a script at the bottom of the page that runs when the page is loaded. A simple re-upload of index.html gets rid of it.
    Thanks
    Karl

  2. #2

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,085
    Thank Post
    511
    Thanked 2,308 Times in 1,784 Posts
    Blog Entries
    24
    Rep Power
    803

    Re: Website Virus

    Has someone got your password for uploading? And what do you mean by a virus?

  3. #3
    contink's Avatar
    Join Date
    Jul 2006
    Location
    South Yorkshire
    Posts
    3,790
    Thank Post
    303
    Thanked 327 Times in 233 Posts
    Rep Power
    117

    Re: Website Virus

    I'd recommend you check the permissions on the site to see if anything is world writeable as that can be part of the problem.

    Next I'd download the whole site and see if there's anything that's been added recently or hidden away..

    Thinking about this a little more you might also want to check when the index.html file was last edited before you overwrite the next "infected" version before checking the access and error logs for your web server to see where the infection could be coming from and how they may be doing it. It's not an exact science but you should spot something in those logs somewhere if you look hard enough.

    Finally as localzuk nudges I'd change the password on the account as it could be someone accessing the account but it sounds more like it could be a problem with the server being exploitable..

    ... actually on that point I'd contact the hosts and check they've got everything up to date and/or patched

  4. #4

    Join Date
    Apr 2007
    Location
    York
    Posts
    548
    Thank Post
    8
    Thanked 4 Times in 4 Posts
    Rep Power
    19

    Re: Website Virus

    Hi guys,
    Thanks for the replys.
    By a virus- i mean when you load the page, it loads, but at the bottom, it says loading http://*****.** - this is usually a site that has the virus. It then pops up at the top - page wants to run ***.exe.
    I wil change the password but i'm pretty certain no-one has it.
    The permission on the www folder is 750.
    When the site has been "attacked" the index.html modified date is different to the local version. Next time it happens i will check the access log.
    I agree- i think its the server been exploitable.
    Thanks

  5. #5
    contink's Avatar
    Join Date
    Jul 2006
    Location
    South Yorkshire
    Posts
    3,790
    Thank Post
    303
    Thanked 327 Times in 233 Posts
    Rep Power
    117

    Re: Website Virus

    Quote Originally Posted by karldenton
    Hi guys,
    Thanks for the replys.
    By a virus- i mean when you load the page, it loads, but at the bottom, it says loading http://*****.** - this is usually a site that has the virus. It then pops up at the top - page wants to run ***.exe.
    I know the sort you mean, I've seen it on a few sites and it's usually a javascript injected into the bototm of the page.

    I wil change the password but i'm pretty certain no-one has it.
    Better to be safe..

    The permission on the www folder is 750.
    That's ok but you may want to check ALL your folders to be sure that there isn't one that is world writeable.. I've had a few sites hacked in similar ways and once they're in they can often do quite a few things so look for other less obvious avenues of ingress.

    Good luck..

  6. #6
    limbo's Avatar
    Join Date
    Aug 2005
    Location
    Birmingham
    Posts
    460
    Thank Post
    2
    Thanked 41 Times in 36 Posts
    Rep Power
    24

    Re: Website Virus

    Check webdav is not enabled on the host server - it is very voulnerable to this kind of attack.

  7. #7

    Join Date
    Apr 2007
    Location
    York
    Posts
    548
    Thank Post
    8
    Thanked 4 Times in 4 Posts
    Rep Power
    19

    Re: Website Virus

    Thanks guys,
    Happened again at 6:57 this morning. The only thing on the log was access from googlebot on robots.txt
    I've changed the password.
    Does anyone know what permission should be on the root, www, and index.html ?
    They are set to 750, which gives user - read,write,execute, group - read and execute, and world nothing.
    Thanks
    Karl

SHARE:
+ Post New Thread

Similar Threads

  1. Virus Question
    By jlr58 in forum Windows
    Replies: 2
    Last Post: 27th June 2007, 08:06 PM
  2. Possible virus spreading?
    By sidewinder in forum Windows
    Replies: 4
    Last Post: 9th February 2007, 02:31 PM
  3. Anti-spyware, virus, etc... ??
    By contink in forum How do you do....it?
    Replies: 2
    Last Post: 14th August 2006, 10:54 PM
  4. Replies: 2
    Last Post: 1st February 2006, 03:05 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •