User Registration
Customer Login

Knowledgebase

Portal Home > Knowledgebase > Articles Database > My site shows a trojan horse when i try to connect to it???


My site shows a trojan horse when i try to connect to it???




Posted by Beatplexity, 12-24-2009, 09:03 AM
http://i47.tinypic.com/2qdy1bb.jpg this has only happened during the last day, does anyone know how i could go about fixing it???
Posted by david510, 12-24-2009, 09:13 AM
There should be code injection in your web files. You can check for them in the files. Check for the pattern as follows.
Posted by gregm11, 12-24-2009, 11:55 AM
You probably have been attacked by an injection. You first need to change all FTP passwords and then clean the pages with the code and check your database as well. Then you need to find out the reason, which is probably caused by old code or insecure code. There is a lot of information out there on SQL injections.
Posted by Ramprage, 12-24-2009, 12:23 PM
View your page source for any javascript or iframe code added. You should also scan your computer, apply all patches and change your ftp password.
Posted by Beatplexity, 12-25-2009, 02:38 AM
thanks for the responses people i have change all ftp passwords, cpanel password and root password, im having my server monitoring team restore a previous backup of index.php ill get them to check the databases etc coz i have no idea, hopefully they will be able to find out what caused this :/
Posted by bizness, 12-25-2009, 09:14 PM
are you using joomla by chance ?
Posted by hostultimo, 12-26-2009, 01:27 AM
of you are using any cms or blo files which require cnstant updates that is where the injection could have come from. Dont just change the index.ph file...change all o them. You may also need to resubmit your website to google for them to clear the warning from your pge globally
Posted by Beatplexity, 12-26-2009, 03:26 AM
nah im using a custom cms, ive had my server monitoring company look at it and they have told me the following I scanned the server for hacks with RKHunter and it did not detect any signs of hacks, trojans, rootkits, malicious processes, etc. I cleared out the tmp directories to make sure nothing is hiding in there. the site still shows a trojan horse when i try to connect though
Posted by madaboutlinux, 12-26-2009, 04:00 AM
RkHunter and Chkrootkit cannot detect the injected code in your website files. Such code is mostly injected using Ftp so clearing /tmp won't make any difference. You need to check all your files thoroughly to make sure there is no