1

I'm hosting a site for an NGO for several years now. The site seems to be based on a PmWiki backend. I don't know much details because I'm just hosting the site and I'm not the guy who set it up.

I would not ask but the one who created this site several years ago is not available for help currently.

Now people called me up and told me their antivirus software is reporting the site as infected with some kind of javascript based trojans, called "JS:Includer-AWG (Trj)". What is this and how to get rid of it?

enter image description here

I tried to at least find out the installed version of PmWiki but couldnt find any details or a version string on the server.

My main interest now is also to protect the site from future infections. Is this a PmWiki vulnarability? Is my webserver hacked? Where to start?

I have already changed passwords and tried to delete malicious JS files but I want to avoid this to happen again.


Update1:

  • Quttera.com says "No malware detected"...
  • Yandex.com lists the torjan as "Troj/JsRedir-NN" (data provided by Sophos).
  • Sucuri.net says "Website blacklisted" and "compromized".

Update2:

  • This site is running pmwiki-2.2.17 (VersionNum=2002017).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.