Can't duplicate Trojan ??

[system]

Hi Guys, Please be gentle with me… My website hxxp://www.tempsfordstainedglass.co.uk seems to be affected with a Trojan or at least that’s what some of my on-line customers are saying. They all have Avast AV installed which is good however i also have Avast AV installed but i can’t seem to duplicate the problem my customers are experiencing…Why?? In order to fix this Trojan i need to see the problem. True ? Any help or guidance would be greatly appreciated.

Thanks,

Muz

[system]

Hi muzwhizz, welcome to the forum

Could you please modify your link to make it unclickable (i.e. chage http to hXXp) to prevent others potentially becoming infected.

This kind of detection is very common these days, with many ‘legitimate sites’ becoming hacked to distribute malware:

Every 3.6 seconds a website is infected

Unfortunately, it would appear that two .js files on the site are infected.

hXXp://www.tempsfordstainedglass.co.uk/acatalog/actinicextras.js
hXXp://www.tempsfordstainedglass.co.uk/acatalog/actiniccore.js

Both of these contain a script that is not supposed to be there at the end of them.

---

A post worth reading by DavidR

@DavidR post:2

Actually cleaning the file is not going to resolve why you got hacked it will only clean the file (well avast doesn’t clean the file just alerts to it, you have to find and strip out the injected code) and not the cause, you need to contact your host, see below.

– HACKED SITES - This is commonly down to old content management software being vulnerable, see this example of a HOSTs response to a hacked site.

We have patched up the server and we found a weakness in PHP which was helping aid the compromise of some domains. We updated it, and changed some default settings to help prevent these coding compromises. The weaknesses were not server wide but rather just made it easier on a hacker to compromise individual end user accounts.

I suggest the following clean up procedure for both your accounts:

1. check all index pages for any signs of java script injected into their coding. On windows servers check any “default.aspx” or
   “default.cfm” pages as those are popular targets too.

2. Remove any “rouge” files or php scripts uploaded by the hackers into your account. Such scripts allowed them to make account wide
   changes, spam through your account, or spread their own .htaccess files through all of your domains in that end user.

3. Check all .htaccess files, as hackers like to load re-directs into them.

4. Change all passwords for that end user account. The cp password, the ftp password, and any ftp sub accounts. Make sure to use a
   “strong” password which includes upper case, lower case, numbers and NO COMPLETE WORDS OR NAMES!

This coupled with our server side changes should prevent any resurfacing of the hackers efforts. In some cases you may still have coding which allows for injection. All user input fields hidden or not should be hard coded, filtered, and sanitized before being handed off to php or a database which will prevent coding characters from being submitted and run through your software.

Also see, Tips for Cleaning & Securing Your Website, http://www.stopbadware.org/home/security.

-Scott-

[system]

Thanks Scott. I’ll give it a bash… :

[system]

Scott, seems to be working fine now… I went back to an old snap shot, did a purge and refresh.
Is this generally a host problem ? Server ?
I had a similar problem about 2 months ago and my host weren’t that helpfull and denied any wrong doing at there end. I’m just about to change host from Pinbrook to Actinic… Wise ? Or stupid ?
I’m fairly new to all this and trying to learn the ins and outs… ;D

Muzwhizz

[system]

just guessing…(legit) web sites are infected by hackers. Hosts have a part of responsibility for not securing their servers properly, and somehow site owners for not being even aware of anything most of the time…

[system]

@Logos post:5

just guessing…(legit) web sites are infected by hackers. Hosts have a part of responsibility for not securing their servers properly, and somehow site owners for not being even aware of anything most of the time…

Not sure what you mean… Please explain.

[system]

Hi muzwhizz,

It seems to be ok now, I get no alert.

Usually vulnerabilities are exploited in the software used to manage the site…

As for the hosts thing, sorry I have no idea…

-Scott-