2

On several of the webservers i'm responsible for there's a javascript virus, a trojan downloader according to the antivirus i'm using. It's a minified javascript that's on the bottom of every page requested from the server. I don't know what the cause is. How can I prevent this from happening again?

Improve this question

6 Answers 6

Reset to default
1

Well, learn how to either protect your servers (if the server was hacked) or write safe application code (if that was injected via the application, like "SQL injection" - you may want to google for that).

If using third party softweare, update versions - maybe some popular piece you use is outdated with known security holes.

There is no general answer. Some bot picked one of the hundreds of possible errors / security holes and installed itself into your website.

Hope noone sues you ;) Especially if not maintaining your applications.

Improve this answer
1

Do you use a popular product that gets compromised often? I've noticed that WordPress is so big now that people start exploiting sites within hours of publication of a vulnerability.

Since you're using Joomla, I'd recommend subscribing to the Joomla security RSS feed and being very vigilant about upgrading your software as security fixes are released. If that isn't something that you have the time to do, find a host that will provide you with a managed services offering where they will take care of it for you.

Improve this answer
1
1

Just throwing this out there, but you mentioned it is "at the bottom of every html page", could this be related to an Ad service that is inadvertently serving up a trojan?

Improve this answer
1

The vulnerability is as likely to be in Joomla plugins as Joomla core, so make sure you keep those up to date too. Any CMS has vulnerabilities discovered from time to time, but if you are proactive in keeping everything updated and keep the rest of the server fairly secured you minimise the risks.

mod_security can to some extent detect and prevent exploits against vulnerable websites, but you need to be able to load Apache modules and it isn't perfect. Securing Apache and PHP settings will also help to some extent, but won't avoid SQL injection attacks if you are running vulnerable PHP code.

You can (should) also consider scanning your websites more frequently for embedded javascripts like this one so you can respond quicker. And possibly also actively scanning for vulnerabilities yourself.

Improve this answer
0

It could be anything from SQL injection to an old example CGI script laying around. As TomTom says, you need to update, but find the issue and disable it first, or you may drag the vulnerability along with you.

Improve this answer
2
  • Since i'm using Joomla, it's more likely to be an SQL injection than anything. I've also noticed that the files i've uploaded had user write permissions on; i was hoping to get some specific info about this particular virus and how it spreads(it's a javascript that writes itself at the bottom of every html page, i don't have the expertise to) because there's not much traffic on these websites. Oh well, i guess i'll have to settle for this fix i made and keep a backup always available.
    – Valentin Brasso
    Mar 22, 2010 at 18:53
  • Try dumping the database and look for anything unusual in the data. Also a little upvote love for your helpers would be nice.
    – kmarsh
    Mar 22, 2010 at 20:13
0

Remember that joomla has file manager addons. If you have installed the FTP Layer, your FTP username/password for that site is in the clear in a config file that can be fetched remotely through some of those addons. At that point, they can get in with FTP and make the modifications. If your FTP username that you set with the FTP layer can access more than just your site, you'll want to check those sites as well.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .