troyan horse

[system]

ik heb last van dat er in min index.htm of html een script word geschreven
==== ====

en ik weet niet hoe ik hier van af kan komen kan iemand mij helpen aub Groet Ger

[Lisandro]

Well… it should be an English-only forum…
Could you please, go to an automated translation service, copy & paste your text and get, at least, an automated translation of your writings?
Thanks.

http://world.altavista.com/
http://dictionary.reference.com/translate/text.html
http://www.freetranslation.com/
http://www.worldlingo.com/en/products_services/worldlingo_translator.html
http://translation2.paralink.com/

[system]

I have charge of that minus index.htm or html a script are written
and I dont now how I can come here of finished cannot someone me help please greeting Ger

[system]

From google translate:

I’ve got that in a min index.htm or html script is written…

…and I do not know how I can come off, someone help me please Greetings Ger

---

I’d say from this that the site is repeatedly becoming infected with this script.

Is avast alerting to this script?
regardless, please could you modify it so that the script is not complete, as it could cause an alert (It hasn’t this time but it is good practice to do so)

Also this post by DavidR may help(thanks DavidR):

@DavidR post:4

I think it more likely that simply cleaning the site of the hacked entries only lasts for a short period of time before it gets hacked again.

If the underlying reason how it got hacked in the first place aren’t resolved it will happen again and again.

This is commonly down to old content management software being vulnerable, see this example of a HOSTs response to a hacked site.

We have patched up the server and we found a weakness in PHP which was helping aid the compromise of some domains. We updated it, and changed some default settings to help prevent these coding compromises. The weaknesses were not server wide but rather just made it easier on a hacker to compromise individual end user accounts.

I suggest the following clean up procedure for both your accounts:

1. check all index pages for any signs of java script injected into their coding. On windows servers check any “default.aspx” or
   “default.cfm” pages as those are popular targets too.

2. Remove any “rouge” files or php scripts uploaded by the hackers into your account. Such scripts allowed them to make account wide
   changes, spam through your account, or spread their own .htaccess files through all of your domains in that end user.

3. Check all .htaccess files, as hackers like to load re-directs into them.

4. Change all passwords for that end user account. The cp password, the ftp password, and any ftp sub accounts. Make sure to use a
   “strong” password which includes upper case, lower case, numbers and NO COMPLETE WORDS OR NAMES!

This coupled with our server side changes should prevent any resurfacing of the hackers efforts. In some cases you may still have coding which allows for injection. All user input fields hidden or not should be hard coded, filtered, and sanitized before being handed off to php or a database which will prevent coding characters from being submitted and run through your software.

Also see, Tips for Cleaning & Securing Your Website, http://www.stopbadware.org/home/security.