Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'm hosting a site for an NGO for several years now. The site seems to be based on a PmWiki backend. I don't know much details because I'm just hosting the site and I'm not the guy who set it up.

I would not ask but the one who created this site several years ago is not available for help currently.

Now people called me up and told me their antivirus software is reporting the site as infected with some kind of javascript based trojans, called "JS:Includer-AWG (Trj)". What is this and how to get rid of it?

enter image description here

I tried to at least find out the installed version of PmWiki but couldnt find any details or a version string on the server.

My main interest now is also to protect the site from future infections. Is this a PmWiki vulnarability? Is my webserver hacked? Where to start?

I have already changed passwords and tried to delete malicious JS files but I want to avoid this to happen again.


Update1:

  • Quttera.com says "No malware detected"...
  • Yandex.com lists the torjan as "Troj/JsRedir-NN" (data provided by Sophos).
  • Sucuri.net says "Website blacklisted" and "compromized".

Update2:

  • This site is running pmwiki-2.2.17 (VersionNum=2002017).
share|improve this question
1  
You can find PMWiki here: pmwiki.org There is a newer version pmwiki-2.2.64 found here: pmwiki.org/wiki/PmWiki/Download You can research changes on the site here: pmwiki.org/wiki/Site/AllRecentChangesShort You can research known PMWiki vulnerabilities here: web.nvd.nist.gov/view/vuln/… –  closetnoc May 12 at 16:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.