Forum Moderators: phranque

Message Too Old, No Replies

Website being infected with virus

Visitors to the site prompted to close browser or have computer infected

         

Automotive site

1:49 pm on Aug 20, 2010 (gmt 0)

10+ Year Member



I have several sites in web hosting account and I believe one of these sites is being infected with virus which in turn affects the other sites in the account. So when people find one the sites search engines, they are prompted with a virus message rather being directed to the site. They are asked to close the browser.

I believe its one of my competitors doing this. All my sites are run on Wordpress and is it possible they are managing to do this through the user comments? If so, should I just close the comments?

Luckily, I do make regular backup, but its a real pain to have to get someone to remove the malicious code everytime this happens and costs me a bit of revenue, not to mention the cost of getting someone to remove the bad code.

Tropical Island

1:57 pm on Aug 20, 2010 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



If you are running ads it could be from one of those.

Automotive site

4:19 pm on Aug 20, 2010 (gmt 0)

10+ Year Member



Only run Adsense and Chitika on them.

rocknbil

5:15 pm on Aug 20, 2010 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



And it strikes again . . . . first, don't assume it's a competitor. It might have even been you, without knowing it, especially if it's hitting all your domains.

Do your site files have any of the symptoms here [webmasterworld.com]? I'm suspecting they do, you said the "W" word and every encounter I've had with this has two common elements: Wordpress and tiny_mce.

If this is the case, the good news is, your site doesn't "have a virus," your files have been modified to spread this thing. This is tedious, but not that difficult to eradicate, details in that link. The most important part: before doing anything, update your AVG, take it OFFLINE, run the scans, then change all your passwords. FTP, WP, Control Panels, everything. Call in a reliable local computer tech if you have to, make sure you're squeaky clean. Then set out cleaning your site files.

I am not blaming WP or tiny_mce, the most believable (yet unconfirmed) scenario is that a webmaster (you?) goes to a web site that has this code. Your AVG doesn't catch it. You get a white page, nada, shrug it off, close the window and forget about it. But a malware has just been installed.

It somehow either piggy backs your FTP connection, or just mods WP files locally so when you upload them, they have the JS code pointing to a compromised server to populate.

"Correlation does not mean causation" - I find it interesting WP and tiny_mce are always present when I see it, but this does not mean they are the cause.