How to find virus in source code

Discussion in 'Security' started by websitemaker111, Oct 2, 2012.

0
  1. #1
    Recently a malicious code was inserted inside my website. It was inserted into the source code of a URL such as www.mysite.com/page/2?sort=name now my question is how do I remove this malicious code from this URL. Do I have to go into database or is it in the FTP. I am using wordpress btw. Thanks.
     
    websitemaker111, Oct 2, 2012 IP
  2. MilesWeb

    MilesWeb Well-Known Member

    Messages:
    869
    Likes Received:
    35
    Best Answers:
    7
    Trophy Points:
    173
    #2
    Perform a scan with clamscan OR maldet on the files, folders & databases. This should help in showing the injected files.
     
    MilesWeb, Oct 5, 2012 IP
  3. slackersecurity

    slackersecurity Peon

    Messages:
    10
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    1
    #3
    grep for php functions like base64_decode, symlink, system, exec, popen, eval then search every *.js *.html *.php file for iframes / malicious jscripts.

    Once you have found and removed the backdoor code you will need to find the point of entry so this dont happen anymore.
     
    slackersecurity, Oct 5, 2012 IP