Urgent help regarding malware virus on website - Page 5

martin1973 · 17th April 2007, 08:45

Just noticed the site has dropped all the £ signs when its been uploaded by the pixies, have sent a couple of emails but no reply as yet...

Simon W · 17th April 2007, 20:34

Quote:

Originally Posted by martin1973

Hi

Ive my own business and website www.goosemirecottages.co.uk and received the following email

-
Hi
I am looking for accommodation in the Lake District and landed on your web
site. The following link
http://www.goosemirecottages.co.uk/s...pertyID=447176
resulted in a virus report from 2 different anti-virus products. The file in
question is hker[1].htm. The suspected virus is called Exploit-MS06-014
(Trojan).
Any thoughts?
Regards
Tony
--

Anyway i checked the link and there is a virus which kaspersky picks up, but it seems to be on all of the sites pages.

Could the email have been a hoax and downloaded a virus onto the site, any other idea how a virus could be put onto the site and how could it be removed?

Thanks for your help

Martin - this isn't much help but there were a few trojans flying about last week. My system detected one called Trojan.Feutel.av on Friday. Got rid of the damned thing but it was back again on Sunday.

Btw, have you got your website's files backed up offline? If so, you could run a scan on them and if they're all clear you could re-upload them to replace the ones you have online at the moment. I use this method as a safety system for a website that I maintain for a documentary programme distributor.

hth,

Simon.

PS. They ought to make trojan/virus writing a hanging offence.

martin1973 · 17th April 2007, 21:19

Hi Simon

I only had the files ive tweaked backed up, ended up going through every folder deleting the virus code (even on older versions of pages) went to re-upload checked the site first and the virus had been removed as well as the £ sign. Been away today and web designers didnt reply to my emails so will ring tomorrow and chew a few ears

Will keep a back up and try and sort out the files and remove the older stuff.

Hanging is far too quick a death, how about death by cheese grater with a squeeze of jif lemon here and there for good measure (i would faint am no good with gore)

Simon W · 17th April 2007, 21:56

Quote:

Originally Posted by martin1973

Hi Simon

I only had the files ive tweaked backed up, ended up going through every folder deleting the virus code (even on older versions of pages) went to re-upload checked the site first and the virus had been removed as well as the £ sign. Been away today and web designers didnt reply to my emails so will ring tomorrow and chew a few ears

Will keep a back up and try and sort out the files and remove the older stuff.

Hanging is far too quick a death, how about death by cheese grater with a squeeze of jif lemon here and there for good measure (i would faint am no good with gore)

I hope you get it sorted Martin. Once you know the site is clean, I'd copy absolutely everything onto your own PC using exactly the same directory/folder/file structure as the working website, then keep the whole shooting match as a backup. (With several DVD-RW safety copies too, in case your machine's hard drive goes belly up).

Whenever I make a change to the site I mentioned earlier (which is very often), I alter the relevant files on my PC and then re-upload them. That way, the PC here holds the master up-to-date version offline and the online 'copy' is merely its twin. It's very time consuming but it does mean that even if the online site got wiped out completely, I could re-upload everything and it would all work again straight away.

(NB. If you don't make regular changes to your site, then the aforementioned system is very easy - far less hassle than I have to go through).

Rich and GG obviously know much more about the complexities than I do so if I were you I would take their advice. (I'm no expert - I just operate on idiot-proof logic!)

Good luck Martin.

Simon.

PS. To hell with the gore factor - hanging, drawing and quartering is the correct way to treat these scumbag virus/trojan writers.
:SHOCKED:

martin1973 · 17th April 2007, 22:40

I do tweak and alter it several times a month, depends if have any offers on or last minute availability lists.

Will have to get a full back up of the asp pages css stylesheet etc and not just the html pages ive butchered.

Ok how about putting them in a freezer for a few hours then boiling them alive

martin1973 · 17th April 2007, 22:42

Ooooh my new banner advert is up, after the great free help received last night thought would pay something back to help keep the site up and running.

GreyGhost · 17th April 2007, 22:44

Thanks Martin, as said make any changes if you wish but keep name and location same.

Happy hunting.

Simon W · 17th April 2007, 22:49

Quote:

Originally Posted by martin1973

Ok how about putting them in a freezer for a few hours then boiling them alive

Too painless!

Lovely looking places you have there Martin. I hope you're doing well with them. Mini-paradise -The Lakes.

Website I mentioned earlier (in process of revamping):
http://www.espressotv.com/1066bayeuxtapestry.htm

There are approx 600 files that make up this site.

martin1973 · 18th April 2007, 14:00

Good looking site Simon, cant be doing with these fancy flash sites etc, they look good for the homepage but then get annoying as are often slow and distracting.

Netizen ran a script to clean up the server within an 1 1/2 hours of being infected, which explains why the site was suddenly virus free again.

I like to think it was the evil pixie

They are going to replace the £ signs and have insured me the server is far more secure now..

Simon W · 18th April 2007, 22:55

Yes it's quite a simple site but fairly effective - I didn't design the original version, I just expanded it and added hundreds & hundreds of pages/pics.

It's a lot to maintain & keep up to date. Some of the pages need revamping as we speak and the red buttons on the black bar (LHS) could do with changing for a better colour and style.

There are some very interesting documentaries though if you trawl through the 'By Title' list. The Bayeux Tapestry programme is an outright winner if the guys can get the rest of the money to make it.

Glad to hear Netizen got rid of the virus. Those NAUGHTY WORD-NAUGHTY WORD-NAUGHTY WORD-NAUGHTY WORD-NAUGHTY WORD-NAUGHTY WORD- pixies get everywhere!

17th April 2007, 08:45	#41
martin1973 Loves to post MG ZT Join Date: Jan 2007 Location: Kendal, Cumbria Posts: 456 Thanks: 0 Thanked 0 Times in 0 Posts	Just noticed the site has dropped all the £ signs when its been uploaded by the pixies, have sent a couple of emails but no reply as yet...

17th April 2007, 21:19	#43
martin1973 Loves to post MG ZT Join Date: Jan 2007 Location: Kendal, Cumbria Posts: 456 Thanks: 0 Thanked 0 Times in 0 Posts	Hi Simon I only had the files ive tweaked backed up, ended up going through every folder deleting the virus code (even on older versions of pages) went to re-upload checked the site first and the virus had been removed as well as the £ sign. Been away today and web designers didnt reply to my emails so will ring tomorrow and chew a few ears Will keep a back up and try and sort out the files and remove the older stuff. Hanging is far too quick a death, how about death by cheese grater with a squeeze of jif lemon here and there for good measure (i would faint am no good with gore)

17th April 2007, 22:40	#45
martin1973 Loves to post MG ZT Join Date: Jan 2007 Location: Kendal, Cumbria Posts: 456 Thanks: 0 Thanked 0 Times in 0 Posts	I do tweak and alter it several times a month, depends if have any offers on or last minute availability lists. Will have to get a full back up of the asp pages css stylesheet etc and not just the html pages ive butchered. Ok how about putting them in a freezer for a few hours then boiling them alive

17th April 2007, 22:42	#46
martin1973 Loves to post MG ZT Join Date: Jan 2007 Location: Kendal, Cumbria Posts: 456 Thanks: 0 Thanked 0 Times in 0 Posts	Ooooh my new banner advert is up, after the great free help received last night thought would pay something back to help keep the site up and running.

17th April 2007, 22:44	#47
GreyGhost Banned 180+ Sport Auto Join Date: Oct 2006 Location: Bedford Middle Level Posts: 17,787 Thanks: 0 Thanked 18 Times in 5 Posts	Thanks Martin, as said make any changes if you wish but keep name and location same. Happy hunting.

18th April 2007, 14:00	#49
martin1973 Loves to post MG ZT Join Date: Jan 2007 Location: Kendal, Cumbria Posts: 456 Thanks: 0 Thanked 0 Times in 0 Posts	Good looking site Simon, cant be doing with these fancy flash sites etc, they look good for the homepage but then get annoying as are often slow and distracting. Netizen ran a script to clean up the server within an 1 1/2 hours of being infected, which explains why the site was suddenly virus free again. I like to think it was the evil pixie They are going to replace the £ signs and have insured me the server is far more secure now..

18th April 2007, 22:55	#50
Simon W This is my second home Rover 75 2.0 Litre Club Saloon Join Date: Nov 2006 Location: S Posts: 3,280 Thanks: 38 Thanked 50 Times in 47 Posts	Yes it's quite a simple site but fairly effective - I didn't design the original version, I just expanded it and added hundreds & hundreds of pages/pics. It's a lot to maintain & keep up to date. Some of the pages need revamping as we speak and the red buttons on the black bar (LHS) could do with changing for a better colour and style. There are some very interesting documentaries though if you trawl through the 'By Title' list. The Bayeux Tapestry programme is an outright winner if the guys can get the rest of the money to make it. Glad to hear Netizen got rid of the virus. Those NAUGHTY WORD-NAUGHTY WORD-NAUGHTY WORD-NAUGHTY WORD-NAUGHTY WORD-NAUGHTY WORD- pixies get everywhere!