What do you do when your website gets infected?

hankyknot · Jun 27, 2008

A couple of years ago I translated a website for a client and started hosting it on a rented server. Today i went to the site and got an alert from AVG that the site is infected with Framer.Z

Now I hevn't made any changes to the site for over a year and I got no such alert yesterday.

How do I go about cleaning my site while its on someone elses server and how on earth did the site get infected in the first place?

I actually ended up moving the hosting after getting really poor service from the hosting company but I cant find the original site on my hard drive so I'm left with downloading it from the previous host but if its infected I really dont want to do that.

Any ideas?

The site is chaletetoiledemerDOTcom

chaslang · Jun 27, 2008

There are infections at this web page. Either they were there from when you designed it or someone or something modified your scripts. I get quite a few detections on the first two pages just using McAfee. JS/Spy-Agent.bw.dldr Trojan, Exploit-IFrame Trojan, and VBS/Psyme Trojan. In fact if I just let the main page sit in IE for awhile and your scripts are rotating images, IE will crash.

You need check out your code to make sure it was not modified and if not, you then need to modify your code because whatever you wrote in the javascripts and html code is considered bad.

Also see the below for some addition info:

http://www.bobistheoilguy.com/forums/ubbthreads.php?ubb=showflat&Number=1140472
http://freeforum.avg.com/read.php?4,120492,sv=

Below is a snapshot of what McAfee saw on the main page.

hankyknot · Jun 27, 2008

Thats the bizarre thing, all we did was copy the pages, rename them, translate the text and update the links and there were no problems at all. My system was scanned regularly when we were working on the site and as recently as Monday I visited the site and no alerts whatsoever. Then suddenly yesterday, all hell breaks loose.

I will delete the site and post a temporary page until I get to teh bottom of this.

Thanks for your help

chaslang · Jun 27, 2008

You're welcome.

hankyknot said: ↑

I will delete the site and post a temporary page until I get to teh bottom of this.
Click to expand...

Good idea as some of what I was seeing there could be pretty nasty.

Log in or Sign up

What do you do when your website gets infected?

hankyknot Corporal

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hankyknot Corporal

chaslang MajorGeeks Admin - Master Malware Expert Staff Member