Hot answers tagged malware
4
Figured it out. "Fetch as Googlebot" was reporting the site just fine too. I then used someone's tool to spoof crawler as Google and saw it happening.
The portal plugin for phpBB had some base64 code inserted due to bad permissions (7xx) and I fixed it all.
I'll probably wipe this server out though.
3
You may not be hosting malware now but you have relatively recently:
http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=goodtherapy.org
The script could be randomly injected or perhaps your ISP is cleaning things for you in the background. In any event, your site has been and probably still is compromised and you should be doing a ...
3
There are two steps you need to take.
First, you have to secure your website.
Then you have to go into damage control and try to restore your website's ranking in the search engines.
To secure your website you need to start by changing ALL passwords - particularly ftp but also change anything that requires a password in order to access. Then you should run ...
3
IMO, if you have to ask, then you need to find a webmaster/web developer with some security expertise to handle the situation.
There are millions of ways a site could be compromised and infected with malware. There isn't a magical program you can just run on your server to remove the malware infection. So without knowing how the system was built, how it was ...
3
Once you've cleaned up the pages submit a reconsideration request to bing, for the pages that no longer exist I'd return a 410 (gone) status message so the search engines no longer look for them.
3
It's more than likely your WordPress install has been compromised.
The permanent fix is to follow these steps to ensure it is fully cleaned and to prevent a recurrence. This is the best method to ensure it is 100% clean.
Backup the database
Make a note of the customizations, such as plugins or any other modifications you’ve made.
Remove all files from the ...
2
Here's what Bing say here about if you're penalised for being spammy, but it sounds like it applies to malware too:
Go to Bing E-mail Support and fill out the form completely
Select Content Inclusion Request from the drop-down list. A new drop-down will appear underneath.
From the new drop-down list, select Reinclusion request.
Write a clear and detailed ...
2
The site, with the warning, seems to stay in the google rankings. However, if someone clicks on that listing, they would be taken to a google warning page telling them to go no further. To get to the site you actually have to copy and past the address into your browser's location bar. This would seriously reduce the amount of traffic you get from google.
2
If you can access the site via http, use this script (upload it to your server). It searches for commonly used patterns of the "bad guys" and prints some info in which files which malware code has been found. If you are not able to do that directly on your hosting account, download the whole stuff and use a local webserver to execute the script. I already ...
2
End-user malware systems often use their own databases to identify issues on sites. Some systems use domain-wide blocks while others use page-specific blocks.
Also, I have seen a lag between de-listing at these sites and end user updates. In some AV products, the malware signatures may be local. If the user has not updated their AV in some time, your ...
2
You must fully audit/cleanse any PC that has had the FTP password stored on it.
Remove the password from your FTP clients and change from another PC.
Be very wary of storing the FTP password in your clients - especially if you are not 100% sure the malware has been removed from the infected PC.
This one seems to spread through a few different means, but ...
2
Speak direct to the shared hosting company - it's not impossible there is an issue on that server and other customers are experiencing the same (similar) issues.You already updated your password information which makes no difference.
How long it takes from uploading a file to when it becomes 'hijacked'?
2
I can confirm that there is some malware or misconfiguration interfering with your site. I'm using the command line client called curl. When I make a request with curl, I get something like this:
$ curl -D - http://ps3theme.net/ -s
HTTP/1.0 200 OK
Expires: Sat, 6 May 1995 12:00:00 GMT
P3P: CP=NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM
Cache-Control: ...
2
I've just taken a look at your site and the page seems to be rending my end without any obvious problems and naughty malwares. I've checked your source which looks clean, but you might be experiencing a HTACCESS injection which redirects people or least trys too. Take a look in the htaccess file.
Furthermore...
In your robots.txt you have
User-agent: *
...
2
mark your website as temporary down
rollback to a previous backup (you should have backups from 1&1) that you're sure you weren't infected and you don't loose too much data
upgrade to the latest WP (again)
upgrade any plugins, and remove unnecessary plugins
go online again
good luck!
2
Malware spread by hacked WP sites is, usually, some hidden iframe in the html pages generated by the CMS, so, unless you move the files on your PC and run the CMS locally, there will be almost zero risks.
if you have to test the pages to clean the infection you probably have to take care; use a good antivirus with internet protection features, but again, ...
1
Identify How The File Got Changed
First off you want to address the problem of how they are getting into your system since a chmod 755 means only the owner (The web server, ie Apache/iis) has access to write to the files therefor something else is doing the written to these files via your CMS/SQL/PHP.
Identify how they got in... (Check access.logs, ...
1
Is it safe to assume something outside of the website is affecting it?
No. Your WordPress installation may have malware injected into it and the steps you listed above are not sufficient to clean a hacked WordPress install. If one of the core files has been modified to attempt to redirect visitors to an attack site you may see 310 errors or all sorts ...
1
The problem got solved. After doing some research, I found out that Apache itself can be used to deliver malware.
Some more info on that
http://www.symantec.com/connect/blogs/extending-apache-serve-malware-0
and
http://www.stopthehacker.com/2011/05/23/apache-used-to-inject-malware/
Lot's of more info if you google it.
Thanks for your comments.
1
Ok, there is no easy way to "scan" via an FTP especially as you don't know exactly what you're looking for.
You could download your entire site contents, then do a normal search in the files for things like base64 and eval which will often be obscured in some way. Sadly you have no definite way of telling wether you've got everything or not, hell, there ...
1
The message I get in chrome says:
melfordschoolofmotoring.co.uk contains content from 31.184.242.103, a
site known to distribute malware. Your computer might catch a virus if
you visit this site.
If you look at your website's headers using livehttp headers (see note below about how I found this code) you'll see a request for ...
1
Check this tutorial by sucuri:
http://blog.sucuri.net/2012/05/how-to-submit-infected-site-for-review-with-bing-blacklisting-authority.html.
You start by registering for Bing webmaster tools.
1
What you're asking for isn't likely to exist since a PHP script can't monitor server traffic by itself. The best you can do is find a log analyzer that can analyze your server logs. But if your server is only configured to log standard http traffic, then it probably won't do you any good.
Your webhost might be running software that logs and/or monitors all ...
1
1) Strong passwords (12+ chars, letter+number+specials chars), use of trusted code, application of published security updates to managed code.
2) Virus/Malware scanning at least. If intrusion is suspected, change all your password (using the suggestions from #1 above) for the machine(s). If it's really a problem, hire a professional that specializes in ...
1
If you request a review through Google Webmaster Tools you should see a delisting in about 24 hours providing your site is verified to now be clean.
Repeat instances don't seem to affect this timescale.
We've had a situation in the past where a shared server host was hacked and the sites were continually reinfected. One one particular site I requested ...
1
This was in a php file that had chmod 666
...
Only top voted, non community-wiki answers of a minimum length are eligible
