Can you have a website virus?

[rocknrollstar]

Hi, I help to run a Joomla website, hosted by DreamHosts. Something strange has happened. When the website is loaded in FF and Chrome, everything's fine. However, when loaded in IE (I'm using v9), it's gives a message "windows antivirus has 2012 has found critical process activity...." which I understand is a malware issue.

 

I can't figure out how it got there, or more importantly, how to get rid of it! The website is Silchester School (ingore the 3MB pic on the front!)

 

Thanks in advance for your help.

[SYNACK]

Do you have any ad banner code on it and is it the latest version/patch of Joomla. The common opensource varients are massivly

sought after by scripted attacks which is how they end up affecting stacks of sites all at the same time. This may be what happened to yours, I'd be tempted to restore from a backup and then make sure that all patches/upgrades have been applied, take another backup and hope that the flaw has actually been fixed by the maintainers of the code. This includes making sure your modules are up to date if you have used extra ones.

Edited May 13, 2012 by SYNACK

[Steve21]

Hi, I help to run a Joomla website, hosted by DreamHosts. Something strange has happened. When the website is loaded in FF and Chrome, everything's fine. However, when loaded in IE (I'm using v9), it's gives a message "windows antivirus has 2012 has found critical process activity...." which I understand is a malware issue.

 

I can't figure out how it got there, or more importantly, how to get rid of it! The website is Silchester School (ingore the 3MB pic on the front!)

 

Thanks in advance for your help.

 

Silchester School

 

2012/05/13 15:42:26 +0100 IP-BLOCK 91.230.147.204 (Type: outgoing, Port: 53767, Process: iexplore.exe)

 

Russian Federation Attacks!

 

 

You have injectioned code in it, so it loads everytime.

 

Guessing you're blocking javascript on FF so it's not showing it

 

- Edit - Most likely either old version of cms, old unsecure addons (notice lots of plugins loading), or not filtering input in terms of code

 

Steve

Edited May 13, 2012 by Steve21

[Steve21]

Seems it's spreading too -

 

Check your URLs as they've been modded

 

 

Security warning in the URL:

Letters

Suspicious domain detected.

 

Security warning in the URL:

Silchester School

Suspicious domain detected.

 

Security warning in the URL:

Contacts

Suspicious domain detected.

 

Security warning in the URL:

Internet Safety

Suspicious domain detected.

 

Security warning in the URL:

Catering

Suspicious domain detected.

[Cache]

I host on dreamhost also for my personal sites and had a breach somehow in February where all my php files were infected - I'd check the modified date and the top of a few php files for what will likely be a base64 encoded string as well as for a file called r.php.

 

What I ended up doing for my wordpress install was deleteing and reuploading all the files, but for all other files followed the instructions on this page for the cleaner script http://www.php-beginners.com/solve-wordpress-malware-script-attack-fix.html

Edited May 13, 2012 by Cache

[Arthur]

This must be related to the recent PHP-CGI exploit...

 

151,000 domains attacked via dangerous PHP hole

More than 151,000 domains held by US hosting provider Dreamhost have been targeted by attackers exploiting a dangerous and long-standing PHP vulnerability.

 

As reported by SC Magazine, the PHP-CGI vulnerability had existed since 2004 and allowed remote code execution on current versions of the language.

 

The hole has now been patched, but only after preceeding fixes (versions 5.3.12 and 5.4.2) failed to work.

 

Some 230,000 attacks against the hosts directly attempted to exploit the vulnerability, according to SpiderLabs which obtained the figures from Dreamhost. (Source)

[hit]

Check the contents of the db table jos_menu, URL's to joomla pages should be something like index.php?option=com_content&view=article&id=14 (in the link field). Even if you reload the web pages the problem won't be fixed unless you have a backup of the database. You can fix it without but it's time consuming.

[rocknrollstar]

Great, thanks everyone for your help. I've used a backup from April- a little behind, but better than nothing.