2

For the past couple of weeks at semi regular intervals, this website has had the #c3284d# malware code inserted into some of its .php files. Also the .htaccess file had its equivelant code inserted. I have, on many occasions removed the malicious code, replaced files, changed the ftp password on my ftp client (which is CoreFTP), changed the connection method to FTPS for more secure storage of the password (instead of plain text).

I have also scanned my computer several times using AVG and Windows Defender which have found no malware on my computer which might have been storing my ftp passwords.

I used Sucuri SiteCheck to check my website which says my website is clean of malware which is bizarre because I just attempted to click one of the links on the site a minute ago and it linked me to another one of these random stats.php sites, even though it appears I have gotten rid of the #c3284d# code again (which will no doubt be re-inserted somehow in an hour or so)..

Has anyone found an actual viable solution for this malware hack?

I have done just about all of the things suggested here and here and the problem still persists.

Currently when I click on a link within the sites navigation menu within Google Chrome I get googles Malware warning page:

Warning: Something's Not Right Here! oxsanasiberians.com contains malware. Your computer might catch a virus if you visit this site. Google has found that malicious software may be installed onto your computer if you proceed. If you've visited this site in the past or you trust this site, it's possible that it has just recently been compromised by a hacker. You should not proceed. Why not try again tomorrow or go somewhere else? We have already notified oxsanasiberians.com that we found malware on the site. For more about the problems found on oxsanasiberians.com, visit the Google Safe Browsing diagnostic page.

I'm wondering if it is possible that the Google Chrome browser I am using has itself been hacked? Does anyone else get re-directed when clicking links on the the website?

Improve this question
6
  • Have you changed the passwords on any other ftp accounts on your server? Your username/password might be secure, but the hackers could be gaining access via different account. Alternatively the malware could be running on the server itself - have you checked that?
    – ChrisF
    Commented Jul 24, 2012 at 10:59
  • @ChrisF There is only one FTP account setup at the moment which I am using. I have changed the password several times. I am on a shared server at 1and1, what would be the best way to get that checked? Just the standard customer support line?
    – crmepham
    Commented Jul 24, 2012 at 11:02
  • I would assume so - at least in the first instance.
    – ChrisF
    Commented Jul 24, 2012 at 11:03
  • Is this using Wordpress?
    – Dave
    Commented Jul 24, 2012 at 11:14
  • 1
    If you are on a shared hosting, the hacker could come from outside your application. You should run a diff (or WinDiff) between a backup copy of your work and the infected one. Once you see the difference it should be easy to spot what's wrong (if anything). If you have other third party applications and/or DB you should run diff on those as well. If nothing is wrong probably it's your host's fault (or one of the other hosted services, more likely)
    – milo5b
    Commented Jul 24, 2012 at 11:25

2 Answers 2

Reset to default
2

Speak direct to the shared hosting company - it's not impossible there is an issue on that server and other customers are experiencing the same (similar) issues.You already updated your password information which makes no difference.

How long it takes from uploading a file to when it becomes 'hijacked'?

Improve this answer
3
  • Usually within an hour the code will be back on the index.php file.
    – crmepham
    Commented Jul 24, 2012 at 11:58
  • This suggests it's not your PC, nor anything during the FTP process. I would suggest you contact 1and1, and check if you use any third party plug ins.
    – Dave
    Commented Jul 24, 2012 at 12:03
  • Thanks for the suggestions, when you say speak direct do you mean NOT speak to the random Indian call centre people and find another number for english speaking people more involved in maintaining the servers..sigh?
    – crmepham
    Commented Jul 24, 2012 at 12:31
2

You must fully audit/cleanse any PC that has had the FTP password stored on it.

Remove the password from your FTP clients and change from another PC.

Be very wary of storing the FTP password in your clients - especially if you are not 100% sure the malware has been removed from the infected PC.

This one seems to spread through a few different means, but infecting a PC and scraping FTP passwords from apps like FileZilla seems to be th

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.