Does my site have malware?

Discussion in 'Security' started by Just-Fired, Jun 16, 2010.

  1. #1
    http://www.moviescall.com/

    i put this site for sale but all the people tell me on the thread that the site contains a malware, I dont see it, could any one please help me out in finding the virus or removing it?>
     
    Just-Fired, Jun 16, 2010 IP
  2. submitmaster

    submitmaster Well-Known Member

    Messages:
    329
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    103
    #2
    well, not sure if it has malware or not but it did try to install some sort of active x controller, and screen went black forcing some script, that is annoying and surfers will not return to your site.
     
    submitmaster, Jun 16, 2010 IP
  3. madaboutlinux

    madaboutlinux Member

    Messages:
    250
    Likes Received:
    7
    Best Answers:
    2
    Trophy Points:
    43
    #3
    Check your website files to see if there are any code such as the following

    eval(base64_decode

    OR

    iframe code

    that contains URLs pointing to malicious websites. If you do see any of those, your website is injected. Either have your Hosting provider clean up these contents OR upload a fresh copy of the website and change the account password.
     
    madaboutlinux, Jun 18, 2010 IP
  4. poblo10

    poblo10 Peon

    Messages:
    135
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Sometimes websites don't even have to have malware on them, various anti viruses base things like that on where the server is located. Is your website hosted "Offshore"?
     
    poblo10, Jul 2, 2010 IP
  5. wgcom

    wgcom Peon

    Messages:
    157
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
  6. Dark Legend

    Dark Legend Greenhorn

    Messages:
    60
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    16
    #6
    It could be a script you have installed.
     
    Dark Legend, Jul 6, 2010 IP
  7. REBOOTTHAT

    REBOOTTHAT Guest

    Messages:
    20
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Hi,

    It might be a good idea to sign up to Google webmaster tools which warns you if your site has any Malware infections.
     
    REBOOTTHAT, Jul 11, 2010 IP
  8. ddmd

    ddmd Peon

    Messages:
    60
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #8
    ddmd, Jul 12, 2010 IP
  9. WeWatch

    WeWatch Active Member

    Messages:
    75
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    50
    #9
    This type of infection is generally the result of a stolen FTP password. The password is usually stolen by a virus on a PC that has been used to FTP files to the infected website.

    First, change all FTP passwords - immediately.

    Second, if you're using a free FTP program, you might consider switching to something like WS_FTP by Ipswitch. That software saves the stored passwords in an encrypted form so the virus can't easily use the stolen the password.

    Third, use a program like Malwarebytes, Kaspersky or Avast to scan and clean all PCs. Don't give anyone the new FTP passwords until their PC has been scanned and cleaned and they send you the report showing it's clean. Otherwise, your site will be infected again.

    Fourth, since the virus can also "sniff" the outgoing FTP traffic and since FTP transmits all data, including username and password, in plain text, it's easy for the virus to see and steal the password that way as well. Switch to SFTP. SFTP is like FTP but the traffic is encrypted so it's not so easy to sniff.

    Then, if you have a known good backup of your site, you might want to delete all the files and restore them from backup. Don't just restore the files over the current files, because hackers have been inserting backdoors (shells) on infected websites. This gives the hacker remote control of the infected website even after you've changed the FTP passwords and taken all of the above steps.

    If you need further help, PM me and I can walk you through some steps to get your site cleaned.
     
    WeWatch, Jul 14, 2010 IP