[Help] HTML/Iframe.B.Gen Virus

Embed · 26 Feb 2011 at 12:16

Hey guys,

So I run a gaming website and one of the members came to me saying that he is getting a virus off the homepage... Strange as no-one else is saying this but anyhow I do some research.
I'm reading that it is caused by hackers adding some malicious code into one of the html files on the site. Or is it more than likely to be on his own computer?

Is this true and if so any chance of me finding this file and removing the code?
The site is ran on an E107 platform.

Link to the image of the infection.
http://i307.photobucket.com/albums/nn313/leechloe/eaflog.png

Any thoughts that might help me?
Cheers,
Em

Embed · 26 Feb 2011 at 12:34

Ooo the tards!

look what they did to 2 of my php files!

tntcoder · 26 Feb 2011 at 12:40

I suggest you work out how they injected the code or it will just happen again

Start by changing your FTP passwords.

Embed · 26 Feb 2011 at 12:49

tntcoder said:
I suggest you work out how they injected the code or it will just happen again Start by changing your FTP passwords.

The worrying thing is that all ftp accounts are locked accept mine!
Best go change it... :eek:

tntcoder · 26 Feb 2011 at 13:10

Embed said:
The worrying thing is that all ftp accounts are locked accept mine!
Best go change it...

It's possible it was something else, i.e sql injection with a bad directory permissions on the webserver or old unpatched stuff on your webhost. FTP is most likely target though

demonix · 26 Feb 2011 at 15:36

tntcoder said:
It's possible it was something else, i.e sql injection with a bad directory permissions on the webserver or old unpatched stuff on your webhost. FTP is most likely target though

But outdated software is also a common target since there are those who never update and leave their sites open to these kinds of attacks (this happened on another site I frequent and it only stopped when they updated all the software on the server) so make sure everything is updated and keep updating when new patches are available to avoid any of these kinds of hacks happening.