latox — 2010-09-29T11:11:13-04:00 — #1
There is currently somebody, somewhere going around to websites/servers and editing their .js files.
I was on my website today and saw "greatrow.ru" loading... I was like what the hell?
So I opened httpfox, and saw a .js file loading into my site.
I checked my source code, nothing had been changed.
The greatrow.ru site scans as a virus/malicious - so be careful, check your site - check your .js files.
I didn't download anything nor give anyone access and every .js file was edited?
I'd like to hear some feedback on this also, as I'm not really knowledgeable when it comes to web security, hacking, etc.
I'd also like to hear if it has happened to you.
wewatch — 2010-09-29T12:22:12-04:00 — #2
When performing website forensics, always look for the common denominator first.
Is it your dedicated server?
If so, who has FTP access to the root of the websites?
What website software does each website have? Wordpress? Joomla? osCommerce? ZenCart? All of these have been recent targets (as they are all the time). Be certain all your software is updated and the plugins too.
Do you have the FTP logs? What about the access logs?
Provide more details and I can help you solve the problem of "how"?
system — 2010-10-03T13:43:43-04:00 — #3
Happened to me aswell.
But it was greatrow.ru/Web_host.js
Noone should have access to my ftp-account, but its webspace, maybe the server got hacked and a program added this line to each .js on the whole webserver?
wewatch — 2010-10-03T15:00:07-04:00 — #4
You're correct - nobody "should" have access to your FTP but when you rule out the vulnerabilities of CMS's it sounds an awful lot like compromised FTP credentials.
They it typically happens is this; because there are so many viruses running around the Internet, many of today's best anti-virus products can't stop them all. Sometimes, a virus slips through the best defenses. These viruses look for the file containing the FTP credentials, reads the info, sends it to a server which then infects the website(s) it now has legitimate credentials for.
First, I would suggest you change all FTP passwords - immediately.
Second, scan all PCs for viruses. Make sure you do a full scan. Too many times we discover that people don't set their anti-virus programs to do full system scans. So, if a virus was released on Monday and your anti-virus program didn't get the signature until Tuesday, without doing a full system scan, your anti-virus program would never know it's there.
Then, remove the infection from all your .js files and look at all .php files for any unnecessary base64_decode strings.
Post back here with any other questions you have.
system — 2010-10-04T02:04:19-04:00 — #5
There is no file containing the ftp credentials.
Of course, I already removed the "infections".
Website runs on a shared host. If the host gets hacked, I can't do anything against it.
wewatch — 2010-10-04T05:49:15-04:00 — #6
What FTP software are you using?
aleksejs — 2010-10-04T06:03:08-04:00 — #7
First of all - ask your hosting provider, that they offer something more secure than FTP. [SFTP or [url=http://en.wikipedia.org/wiki/FTPS]FTPS](http://en.wikipedia.org/wiki/SSH_file_transfer_protocol) So that at least your password is not sent unencrypted.
coastweb — 2010-10-04T11:02:47-04:00 — #8