Hacker destroy my webpages (indexfiles)

Viruses and worms
1

I have problem with trojan attack, they change my web sites.

Here is screen dump on virus.

Any have advice for this problem?

Thanks

2

Tjena grabben… hvordan går det med VIK :wink:

Sucuri may help you, but not for free :cry: http://sucuri.net/signup
i have PMd a smart website guy so he may be online soon and can possible help

what is the problem website URL … post it none clickable

3

Then I bought virus software avast unnecessarily >:(

4

what do you mean?

5

You have been attacked through a Zeus backdoor, attack code is being changed all the time all of the time from bulletproof servers.
Avast is not your first line of defense here, your website software should be updated/upgraded, have secure plug-ins.
Server software should not give away too noisy details to attackers.
You should not be vulnerable to PHP attacks and you should have your website software fully patched and upgraded.
Attackers always go for the low hanging fruit, and when you have ripe apples in the shop window for them…

polonus

6

Many thanks for good answer “polonus”

I understand what you mean :slight_smile:

Need update webpage.

Many thanks

7

Now my 3 pages is hacked again :-X

http://www.salapc.se/shopen/

Thanks POLUNUS for message, shall i use this script in index page?

Thanks

8

sucuri report. http://sitecheck.sucuri.net/results/www.salapc.se/shopen/

http://labs.sucuri.net/db/malware/malware-entry-mwdefaced01

9

Hi alfons38,

Here you see a couple of items you should consider, as shown by this example: https://securityheaders.com/2013/06/02/com-theus.php
This is at the culprit: http://git.php.net/?p=php-src.git;a=commitdiff;h=7d163e8a0880ae8af2dd869071393e5dc07ef271;hp=e964817b244d091dc38f59f5d7f1735110b698af (link author Rob Richards)

polonus

10

Now i have this problem.

****MYIP - - [30/Aug/2013:18:59:09 +0200] “GET /index.php HTTP/1.1” 302 - “http://www.autoconsultab.se/” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.57 Safari/537.36”
****MYIP- - [30/Aug/2013:18:59:09 +0200] “GET /xampp/ HTTP/1.1” 403 1318 “http://www.autoconsultab.se/” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.57 Safari/537.36”
65.36.241.76 - - [30/Aug/2013:18:59:25 +0200] “GET / HTTP/1.1” 302 - “-” “InternetSeer.com”
65.36.241.76 - - [30/Aug/2013:18:59:56 +0200] “GET / HTTP/1.1” 302 - “-” “InternetSeer.com”
65.36.241.76 - - [30/Aug/2013:18:59:56 +0200] “GET / HTTP/1.1” 302 - “-” “InternetSeer.com”
180.76.6.29 - - [30/Aug/2013:19:01:18 +0200] “GET /shopen/index2.php?page=shop.product_details&product_id=508&flypage=flypage-ask.tpl&pop=0&option=com_virtuemart&Itemid=100001&vmcchk=1&Itemid=100001&pop=1&tmpl=component HTTP/1.1” 404 1056 “-” “Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)”

I cant use my domain on my web server now.

What i doing, i think antivirus software product this problem???

11

Normalized URL:
http://www.autoconsultab.se
Last scan date:
vrijdag 30 augustus 2013 22:40:44
Current status:
Address is unreachable

polonus