My Website Has a Virus And My Web Host is Acting Noobish

Portal Home > Knowledgebase > Articles Database > My Website Has a Virus And My Web Host is Acting Noobish

Posted by MGMGrand, 11-11-2013, 09:37 AM
My current web host is really disappointing. It seems like they are playing dumb and want to argue. My website, has a virus in the members area. And I don't know how to remove it without them doing a proper virus scan. Virus: VirTool:JS/Obfuscator.Q VirTool:JS/Obfuscator are detection's for programs that have had their purpose obfuscated to hinder analysis or detection by anti-virus scanners. They commonly employ a variety of techniques such as encryption. Manual removal is not recommended for this threat. To detect and remove this threat they need to run a full-system scan with Microsoft Safety Scanner.
Posted by LVPSHosting, 11-11-2013, 10:16 AM
Why don't you remove by your self? What did they told you (your hosting company) that makes you think that they do not want to help?
Posted by MGMGrand, 11-11-2013, 10:16 AM
I clearly explained that they need to use that Microsoft malware tool to clean it or one that does have the definition for that specific virus. It's kinda like they can't read English very good. Here are their responses so far:
Posted by MGMGrand, 11-11-2013, 10:20 AM
How do I remove a virus that is embedded or hidden on a server?
Posted by WPCYCLE, 11-11-2013, 10:28 AM
If you are able to communicate with host, ask them if they any tool installed to clean viruses and malware....which they should have. A server without such tools is foolish for many reasons. If your still stuck, start searching for a reputable host and talk to them about the situation before signing up, OR hire someone/company to clean it.
Posted by my247webhosting, 11-11-2013, 10:38 AM
You can clean by downloading to local computer and running a scan using norton. Normally a host should support this to assist in cleaning
Posted by MGMGrand, 11-11-2013, 10:54 AM
Nice, I was going to ask about doing that. I had that idea a few hours ago actually but I goofed up and ran the scan on the zipped folder. But I just unzipped and ran the scan and I think it found the virus. I'm not sure because it was still showing the alert from the previous encounter.
Posted by MGMGrand, 11-11-2013, 11:01 AM
OK it is fixed now. I think I wiped it out. Last time I needed help from them I was banned from my own website because someone in my house was visiting my website on their laptop and it caused my server to ban me. And my web host kept telling me to clear my cache, and I ended up solving the problem myself, because it was my router causing it. Just like now..
Posted by UH-Bobby, 11-11-2013, 11:03 AM
I'd recommend running Malwarebytes against it too. I've usually had better results out of the Malwarebytes than anything else. But yes, your host really should have or be able to assist in this. The fact that they are saying your site looks fine, and that they have a secure firewall and that there is nothing to worry about is worrisome. While they may truly have a good firewall, there's more to security than just a firewall. Security is about using different layers (within reason) to defend against bad stuff. Firewall is one piece of that.
Posted by JohnStern, 11-11-2013, 11:37 AM
You are saying that your router caused a virus to appear on your web site?!
Posted by my247webhosting, 11-11-2013, 07:56 PM
Please check your control panel there may be option for account virus scan, or ask your hosting provider to do a virus scan on your account to remove the infected file.
Posted by MGMGrand, 11-11-2013, 09:34 PM
No I meant my web hosting provider fails every time I have a serious problem. My router was telling my server that two people we're signed in on one IP so my server banned my mac address, at least I think that's what happened so I changed my router mac address settings and I have had no problems since then.
Posted by MGMGrand, 11-11-2013, 09:37 PM
So now the virus is back. And it seems to be re-installing itself or some person or bot is re-injecting it.
Posted by NateN34, 11-12-2013, 03:19 AM
Re install your webserver and site on a Linux distro.
Posted by MacroBash, 11-12-2013, 05:54 AM
move your Website to Linux Host.
Posted by Buycpanel-Kevin, 11-12-2013, 06:58 PM
Try backing up data you are sure isn't affected and restore the server to defaults and re install everything from the backups. But it seems to me that your web hosts should be helping you out here...
Posted by MGMGrand, 11-16-2013, 05:03 PM
I contacted the creator of the websites script and after a few days he told me that he couldn't find anything. And he said the alert is a false positive created by J query code. Which makes since because the website design uses the new twitter bootstrap template system. And the fact that my virus alert is not being triggered on my index page says that something else was probably triggering it. The coder said, the HTML security that he has coded into it is triggering the false positive and any sensitive parts of the template are stored in the database.