Hacked Sites

stender · Jul 15, 2009

I've had a few sites hacked whereby IFRAMES have been placed within index files which causes google to block your site due to malware. It smells like there are virus' which snoop ftp traffic although i've picked nothing up on my pc. I use dreamwaver to do all my sites which is obviously a security risk, so can anyone recommend a user friendly way of managing my sites say using sftp?

Thanks.

grantw · Jul 15, 2009

Have you checked the html files on your PC? There is a virus around that adds the iframe to html files stored locally on your pc rather than it being done on your server.

Grant

domainking · Jul 15, 2009

Hi Stender

check your ftp settings thats whan caused the probelm last year with me. with the iframe virus. better to use direct log in from server

stender · Jul 15, 2009

Have scanned my pc several times with various apps and hijack this and found nothing.

What do you mean check my ftp settings dk?

domainking · Jul 15, 2009

I was using a payed ftp program and was hacked into giving my login details ect ect for about 300 sites. took me about 6 weeks to get all sorted and we traced it back to the ftp software.

so from now on we only do work now direct to server

grantw · Jul 15, 2009

To rule out a virus on your pc you just need to look at a html file and see if the iframe is there, if it isn't then it's probably not a virus on your pc.

Grant

stender · Jul 15, 2009

i've found iframes on html and php pages.
1 plain html site, 1 gallery2 site, 1 brand new wordpress site (just started luckily). normally a url to some .ru site in the frame.
It's gonna be a pain in the arse developing in dreamweaver but uploading using something else!
worst thing is how long it takes to spot. 1 site was ranked page 1 of google and now nowhere.

bb99 · Jul 15, 2009

Where are you hosting the sites Stender - it could be that the server they are on is compromised?

Also if you have used your own or any 3rd party PHP code (scripts, software) you should check that it isn't vulnerable in any way.

We once had a very old version of Twiki hidden away on an old domain name... It had several known security issues which were all fixed in the latest version, but we were running the old version. Some git in Turkey found it and exploited it and managed to deface four other sites (running Wordpress).

If you're on a shared server it could be that another user's site has been hacked and this in turn has let the attacker insert the code into your site.

Food for thought, good luck with sorting it all out.

stender · Jul 15, 2009

I've just seen that one of the sites which was hit and that I reinstalled has just been hit again, and thats after me changing the password.
It's smelling more of a virus. I'll have to scan my work pc.
The site in question has had an iframe stuck in the top of the body of index,php and is running gallery 2 and the index.php under that has an iframe at the bottom and the rest of the code has been deleted.

The site was first hacked on 1 host, i then moved it to another and it's happened again. Which again smells of a virus as grant has suggested.

I did notice delalien has just posted he's been hacked via ftp though.

bb99 · Jul 15, 2009

stender said:
I've just seen that one of the sites which was hit and that I reinstalled has just been hit again, and thats after me changing the password.
It's smelling more of a virus. I'll have to scan my work pc.

Hard to say without knowing a lot more but that smells to me like the server is compromised rather than it being a virus on your PC.

stender · Jul 15, 2009

found this

Iframe Virus Fix | Google Webmaster Tool | Cogzidel Technologies

bb99 · Jul 15, 2009

stender said:
found this

Iframe Virus Fix | Google Webmaster Tool | Cogzidel Technologies

Can't argue with that :cry:

squarerobot · Jul 17, 2009

Hi,

Not sure if it'll be much use to you guys, but I wrote a blog post a couple of years back about this exact issue having heard it a lot during my time back when I used to work in tech support:

Help! My Website Has a Virus! - Bot Log

stender · Aug 5, 2009

It's happened again! I have a site running gallery2 and again it's had iframes added and been marked as unsafe by google.

I scanned my pc's with malware bytes and found a trojan, removed it and then changed my passwords and changed dreamweaver so it didnt store them. All fine for weeks until 01:56 on the 3rd!