How does a virus infect a website?

R

RacerX780

n00b
Joined
Oct 18, 2006
Messages
32
I have a website for my biz and the otherr day when I went to it AVG put up a warning... I wasn't sure if maybe it was my laptop or what... so I had a couple of my friends check and of course they got it too.

I then downloaded the files from the site on another machine and Windows anti-virus was flagging almost all the files.... I turned that off, downloaded them again, ran AVG on the folder, and AVG was going crazy.

This is what google is saying:

http://www.google.com/safebrowsing/diagnostic?site=dnswt.net


And this is the error that AVG throws up:

dns-website-error.JPG



I use Jaguarpc for hosting... been with them for 10+ yrs. I have my one main domain, azclan.net - and then several sub-domains... one of which is for my biz. *That* is the only domain to be having this problem.

AVG won't clean the files... of course, I don't have the orginals to restore... and Jaguar doesn't have backups far enough back (only about 2 wks old) to get a clean copy.... which is pissing me off even more.

Jaguar said there isn't anything they can do to block this from happening.... which is rather disappointing....

So my two questions -

1. Is there anything that can clean the files, or am I sol?

2. Are there other hosting companies that would block this type of threat? Or is there any way I can pinpoint the cause?


Thanks...
 
Sounds like you got hacked.

Since you have no backup to restore from, here's what I'd suggest.

FTP to your site and sort files by date modified. Look for anything with a date where you know you did not modify it. It should be fairly easy to pinpoint where the damage is coming from. If you are lucky, the hacker only modified your index page and maybe planted a js file. Odds are most of your site is intact and okay.

If you find something suspicious, open the html file in your FTP client (not the same thing as launching a web page, you're only inspecting the source code). Look for anything you know shouldn't be there, like javascript or a reference to another site. You should be able to edit your html files via FTP or locally with Notepad.

Also look for any other files you know you didn't upload. css.js? Wrong format... this would mean someone snuck in a malicious js file. Check your htaccess file, too.

Oh, and then backup your site. ;)
 
Thanks for the tips. When I first discovered it, I checked dates... there were two.. One from back in May, and one from mid-July.

I haven't touched the site in a while... since it's pretty static. (Although I should update it a bit I guess...)

I can't even open the files.... windows says I don't have permission... can't even open them in dos. And I don't have my linux box here.... (another issue in a long list of issues)

There are a couple files tagged with that exploit, and then just about every single html file has this...

avg-results-1.JPG


I am so pissed.... ugh!!!!!!!!!

I d/l'ed some log files... and I'll check out the htaccess file too. Just not exactly sure what I'm looking for other then maybe matching up dates?? If I do some how find an IP address that matches - is there a way to get a hosting company to block that ip? Not that I think it would make much difference at this point...

And yes, I will keep a backup of anything new. You'd think after being around pcs my whole life I'd be better at that. LOL My friend has for YEARS tried to get me to do backups.... I just never think anything would happen. :p
 
Oh well... couldn't clean the files myself, so I had the company that made the site reupload the files. This time I downloaded and burned them to a cd... thinking of putting them on dropbox or something as well... Have no interest in having this happen again at some point. At least now I have a good copy of everything.
 
Always have a backup of your site.

Personally I like to work on my websites locally so I can view changes live on my ".loc" urls and then once it's ready I upload it. That way I'm not messing around on the live site. Naturally, I have a backup that way. DBs and any picture/file uploads get backed up too of course.

Look at your apache logs to see if a SQL/php injection vulnerability was perhaps used to gain access. For example if you have a field in a forum that takes user data, or even a drop down menu (which is nothing more but a text field that's just rendered differently by the browser) then make sure the data being sent to the server cannot have any weird stuff in it that could cause unwanted behavior.

For example, say you have a script like this:

Code: 
$file = $_GET['file'];

exec("cat ".$file);

One could quite easily enter some commands as the file and cause some code to be executed. That's a crude example, but it shows how this can be possible. exec is probably not the only way this could be done, but it's the simplest. Normally a web page wont have that command though but worth checking. Anything in $_GET and $_POST and $_COOKIE cannot be trusted and needs to be sanitized to ensure it's only data you want. Yes, even cookies. While it's not obvious at first, a cookie can easily be manipulated to send custom data to the server.

If you are using a common CMS/Forum software there could be a known exploit as well. Hackers will google for the copyright notice so they can find sites running that version. For example if vbulletin had an exploit they'd do a search for "Powered by Vbulletin".
 
In addition to what Red Squirrel said, people may Google for WAMP, XAMPP, etc exploits if they find out you are hosting on Windows.

What library is that addfav.php a part of? That seems like it might be a decent starting point. Also like Red Squirrel suggested, check your apache logs, both access and error logs.
 
Sgraffite said:
In addition to what Red Squirrel said, people may Google for WAMP, XAMPP, etc exploits if they find out you are hosting on Windows.

What library is that addfav.php a part of? That seems like it might be a decent starting point. Also like Red Squirrel suggested, check your apache logs, both access and error logs.
Click to expand...

I'm not sure about the addfav.php.. that was done by another company a couple years ago. I just kept a copy of that site there.... probably should have deleted it since I wasn't going to use it anymore.

I'll check my logs... see if I can find anything from them.

I just find it odd that it happened at all actually. It's not like a highly visited site... unless one of my competitors did it. lol
 
You must log in or register to reply here.
Back
Top