Trojan Horse Blocked :-JS:IFrame-CG [Trj]

Viruses and worms
1

Hi,

I have just came back from holiday to find my websites with the above problem so I cannot see the websites I have. The main url, hxxp://www.izzy-wizzy.com has the directory listing but none of the folders off it load in either Firefox or IE. My wife’s PC can see them perfectly well but she uses AVG Anti Virus. I have no problem with other websites.

Any suggestions?

thanks and regards,

Stephen

2

sorry but your website is hacked…
Sucuri sitecheck http://sitecheck.sucuri.net/scanner/

See Sceenshot (click to enlarge)

malware info: http://sucuri.net/malware/malware-entry-mwiframehd203

VirusTotal - URL scan
http://www.virustotal.com/url-scan/report.html?id=585a07dc6927dfe20f29297d31f7843a-1312463291

3

Thanks for the reply. I don’t understand the results of what was posted. What can I do to identify what exactly the problem is and how do I fix the problem?

thanks,

Stephen

4

Not sure…well…the sucuri scanner say Malware found in the URL:

hxxp://wxw.broadfieldbkp.co.uk/404testpage4525d2fdc
hxxp://wxw.broadfieldbkp.co.uk/www.broadfieldbkp.co.uk
hxxp://wxw.broadfieldbkp.co.uk/404.shtml

did you put those urls there ?

5

Information for Website Owners http://stopbadware.org/home/webmasters

Tips for Cleaning & Securing Your Website http://stopbadware.org/home/security

Have a single site with malware?, Do you need to have a website quickly cleaned and removed from blacklists? We have you covered. http://sucuri.net/signup

6

SOSWebscan gives the site clean, DrWeb gives it cleanm because it does not scan all
the deeper links Malware found in the URL:
-http://www.broadfieldbkp.co.uk/404testpage4525d2fdc

Malware found in the URL:
-http://www.broadfieldbkp.co.uk/www.broadfieldbkp.co.uk

Malware found in the URL:
-http://www.broadfieldbkp.co.uk/404.shtml - HTTP Error 404: Not Found
:
Checking: -http://www.izzy-wizzy.com/
Engine version: 5.0.2.3300
Total virus-finding records: 2447191
File size: 365 bytes
File MD5: df8cee1987fcf67e8abf4042b9c3c52f

-http://www.izzy-wizzy.com/ - Ok

Anubis report: http://anubis.iseclab.org/?action=result&task_id=1b4fff480d16db6a4b94f4ad6f4b150c9&format=html

But there was a malicious script found through the redirect link to
http://www.google.com/safebrowsing/diagnostic?site=www.broadfieldbkp.co.uk
See for malicious activities: http://sitevet.com/db/asn/AS11798
Malware found in the URL e.g.:
-http://www.broadfieldbkp.co.uk/404testpage4525d2fdc
See: http://sucuri.net/malware/malware-entry-mwiframehd203

polonus

7

Thanks for the pointers. I’ll start with a full scan tonight and work through my sites.

cheers,

Stephen

8

The scan revealed 4 adware/malware gen things that Avast moved to the chest.

Another threat Ricsi-831 is identified with d:\pagefile.sys which can’t be repaired. I tried to move to chest but the isn’t enough space; it’s 786 Meg. Any ideas how I can sort this?

My websites seem to be working correctly now and given clean status by Sucuri.

thanks and regards,

Stephen

9

Delete all files that are detected as Ricsi.806. Deleted files will have to be either replaced from a clean backup or reinstalled. How to delete the Pagefile.sys File can be read here:
http://support.microsoft.com/kb/255205/en

polonus