How Do i Find/Delete a Virus from my server?

Discussion in 'Site & Server Administration' started by mberman84, Jun 13, 2008.

  1. #1
    Ok so I have a wordpress blog (in my sig) and I believe it contains a virus on the server. The reason I think this is because when I was making a backup of the site (downloaded the contents to my computer), my virus protection software popped up and said "Virus found: greeting postcard.exe"

    I did a search for this file, and ran the anti virus on the directory and nothing came up. What should i try now?
     
    mberman84, Jun 13, 2008 IP
  2. IwhiC

    IwhiC Peon

    Messages:
    2,594
    Likes Received:
    61
    Best Answers:
    0
    Trophy Points:
    0
    #2
    IwhiC, Jun 13, 2008 IP
  3. mberman84

    mberman84 Peon

    Messages:
    511
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #3
    hm...how do i use this? (novice with this stuff)

    ps i dont have access to ssh
     
    mberman84, Jun 13, 2008 IP
  4. IwhiC

    IwhiC Peon

    Messages:
    2,594
    Likes Received:
    61
    Best Answers:
    0
    Trophy Points:
    0
    #4
    You need root access.. are you on a shared server? If so then have your host run that on his box to make sure there are no exploits on the server
     
    IwhiC, Jun 13, 2008 IP
  5. CoolGuru

    CoolGuru Banned

    Messages:
    41
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    If u have shared hosting then u can contact ur host about it
     
    CoolGuru, Jun 14, 2008 IP
  6. buldozerceto

    buldozerceto Active Member

    Messages:
    1,137
    Likes Received:
    43
    Best Answers:
    0
    Trophy Points:
    88
    #6
    if you are on linux then you are safe. windows viruses don't work on linux
     
    buldozerceto, Jun 14, 2008 IP
  7. mberman84

    mberman84 Peon

    Messages:
    511
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #7
    I am on my friend's server. I don't think I have root access (I can't use ssh).

    not sure what i'm on:p this stuff is somewhat new to me.

    i only noticed the virus when i put my blog's backup.zip (whole site) on my desktop (windows). my virus scanner popped up and said i had a virus but when i did a search for it, it couldn't find it
     
    mberman84, Jun 14, 2008 IP
  8. 007c

    007c Peon

    Messages:
    611
    Likes Received:
    11
    Best Answers:
    0
    Trophy Points:
    0
    #8
    Um u sure it was actually in the zip?
     
    007c, Jun 15, 2008 IP
  9. Marineguyfla

    Marineguyfla Peon

    Messages:
    34
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #9
    how was the virus put on the server in the first place?
    maybe it was just a coincidence. Or could you find the EXE in your backup files?
     
    Marineguyfla, Jun 15, 2008 IP
  10. mberman84

    mberman84 Peon

    Messages:
    511
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #10
    im pretty sure. the virus alert only appeared when i dragged the files on my computer.
    i am not sure. maybe it was a wordpress exploit. i wasnt the best about keeping WP patched.
     
    mberman84, Jun 15, 2008 IP
  11. mellow-h

    mellow-h Peon

    Messages:
    750
    Likes Received:
    14
    Best Answers:
    0
    Trophy Points:
    0
    #11
    Most likely you need to contact your friend to sort this ;)

    As its working on your computer that means it won't work on your box until the box is windows alone. Though, as you mentioned about SSH, i doubt thats a windows server :) So nothing to be worried about :D
     
    mellow-h, Jun 18, 2008 IP
  12. evn7289

    evn7289 Peon

    Messages:
    27
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #12
    What operating system is running on the server?
     
    evn7289, Jun 18, 2008 IP
  13. mberman84

    mberman84 Peon

    Messages:
    511
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #13
    well I moved my entire site to dreamhost...so i think im fine. if there was a problem, they would have caught it im assuming. i dont know why my virus detector popped up though...weird.

    LAMP...think im fine.
     
    mberman84, Jun 18, 2008 IP
  14. evn7289

    evn7289 Peon

    Messages:
    27
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #14
    You should be good.
     
    evn7289, Jun 18, 2008 IP