frozen.fish 0 Report post Posted June 1, 2009 HelloWould like to know what happend cause all my index files in the server here got virus? What had just happend? I am removing all files right now good thing I just made a backup yesterday. I really dont like this. i havent launched my sites yet and now it's been attacked..Can anyone here explained what had just happend? The change was made last night around 10pm GMT+8 when i was not home, my passwords are really really hard to memorize even i dont know them. so how can someone break in.. :XD: help please.. this is really alarming. Share this post Link to post Share on other sites
nol 0 Report post Posted June 1, 2009 Well if Xisto/Xisto haven't changed anything since I was last here, I've never seen them been attacked, and why somebody would go just into your account and give you a virus is beyond me, I'm sure your computer has a virus/keylogger and that is how it happened, or somehow somebody guessed your password right, so I wouldn't find it hard to believe that this is on your end... Share this post Link to post Share on other sites
frozen.fish 0 Report post Posted June 1, 2009 (edited) so if i have a virus on my computer and i entered my site thru ftp it can get infected? so how to get rid of that thing there? like a fresh install or something is that possible?keylogger? dont think so i use password manager. are they any safe? and password generators.. but i am infected too right now..windows one care and kaspersky spotted a trojan. Edited June 1, 2009 by frozen.fish (see edit history) Share this post Link to post Share on other sites
nol 0 Report post Posted June 1, 2009 first you want to fresh start your computer after you do a virus check with avg, norton, or whatever you have, then you want to change all your passwords, maybe freshstart your website or at least install a backup of what you had. That is what I would do anyways. Share this post Link to post Share on other sites
frozen.fish 0 Report post Posted June 1, 2009 (edited) yes just cleaned things up my proquota.exe got infected and the conflicker came back just this morning but site got infected last night when nobody was online here, just patched up my system too.. ill do fresh install next week maybe..but how do i do a fresh start on my hosting here?by the way thanks a lot for your help nol!Can keyloggers catch passwords from clipboard? im more worried about personal informations right now, if that thing stole datas.. :lol:or was if SQL injection attacks?I really want to know what happend and take steps securing my site.. any inputs are highly appreciated.. Edited June 1, 2009 by frozen.fish (see edit history) Share this post Link to post Share on other sites
takerraj 0 Report post Posted June 1, 2009 yes just cleaned things up my proquota.exe got infected and the conflicker came back just this morning but site got infected last night when nobody was online here, just patched up my system too.. ill do fresh install next week maybe..but how do i do a fresh start on my hosting here?by the way thanks a lot for your help nol!Can keyloggers catch passwords from clipboard? im more worried about personal informations right now, if that thing stole datas.. or was if SQL injection attacks?I really want to know what happend and take steps securing my site.. any inputs are highly appreciated.. Just for clarification, can I know how you can say that your site is affected by virus? Share this post Link to post Share on other sites
frozen.fish 0 Report post Posted June 1, 2009 html script viruses.. antivirus pops up a promptthere were unknown codes on the sourcefile was modified last night all the indexes in the host. but there are no prompts on the index.php but i can see the virus code was inserted there as well. Share this post Link to post Share on other sites
inverse_bloom 0 Report post Posted June 1, 2009 Although i haven't experienced your dilemma and the cause remains vague to me, the first thing i would do is download Kaspersky trial as it is very thorough. A prior warning before installing - if you have ever had AVG installed i believe you will have to delete registry values left over from an AVG uninstall. Kaspersky will continue to refuse installation until this is properly completed. I would also install spybot if you haven't already and another malware program such as malwarebytes. From there scan everything (including your backup). Do a fresh copy on the server. If problems persist then it would perhaps be wise to contact Xisto/Xisto if you haven't already. Sorry that's all i can offer. Share this post Link to post Share on other sites
frozen.fish 0 Report post Posted June 1, 2009 im emailing them right now just finished cleaning up the mess.. Share this post Link to post Share on other sites
webishqiptar 0 Report post Posted June 1, 2009 me once had some kind of problem with viruses, and I saw some really weird pages(porn and spam) getting indexed with my other site pages, and I found those and removed manually through ftp. I am not sure, what happened, but maybe you should try to get a good Antivirus on your computer such as kaspersky and also a good spyware, and never go to lots of sites who contain crack things or similar behavior software. And since I upgraded to Vista my computer has always less problems regarding security, viruses, spyware. Share this post Link to post Share on other sites
frozen.fish 0 Report post Posted June 1, 2009 aha.. i found something fishy very rotten fish in my access logs im not so sure what is is though im fairly new to this.. there was a weird refer on the last 300 visitor stats before the site got modified..the referer came from roidsmal.com/links_catalog.php im not really sure what is that.. if its a referer it came from that one right.there is very very little traffic here so getting around the visitors aint that hard.. Share this post Link to post Share on other sites
frozen.fish 0 Report post Posted June 2, 2009 (edited) That thing is at it again.. I dont know what really is the problem but i dont think it's at my end now.. It was hacked this noon.. all the index got script virus..Can someone help me.. I am about to launch a site and if this keeps going.. its being a pain in the a** Edited June 2, 2009 by frozen.fish (see edit history) Share this post Link to post Share on other sites
webishqiptar 0 Report post Posted June 2, 2009 hey frozen fish, why don't you try virus scanner on the Advanced Part of Cpanel? I guess you are hosted here at Xisto - Web Hosting right?Just make a scan..and share here the results.. Share this post Link to post Share on other sites
frozen.fish 0 Report post Posted June 2, 2009 no virii found..Is SQL injection possible there are no known exploits on the phps i use.. Share this post Link to post Share on other sites
webishqiptar 0 Report post Posted June 2, 2009 yes sure sql injection is possible, but what kind of website do you have??Do you use a cms or what?? Share this post Link to post Share on other sites
