Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

I have a critical virus infection to one of my website.

There is a additional script found added at footer of few web pages . the pages are html pages. and all his index.php has a curl script added automatically which access some malicious code to be downloaded on people who view the website. The script is that much dangerous that it immediately destroys the accessing person system if there is no antivirus. The developer working on this website himself got 5 times system formatted in last 6 days.

Condition become more critical because the script keep on coming back after deleting from infected files. Now we are in worst condition that it has spread to all 8-10 websites developer is working on from last 6 months. BTW: we are using open source framework for developing these websites mainly we used Magento, CakePHP, wordpress.

IF YOU CAN HELP OUT ON THIS SUBJECT, PLEASE PROVIDE ANY OF YOUR PREVIOUS EXPERIENCE OR KNOWLEDGE TO HANDLE SUCH SITUATION.

All suggestions are appreciated.

P.S. If you guys need I can post the malicious script here which is added in my html and php files.

Edit: Is there any programming solutions to remove the added malicious code from website??

share|improve this question

migrated from stackoverflow.com Feb 4 '12 at 6:37

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Shane Madden, voretaq7 Feb 4 '12 at 7:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3  
"I can post the malicious script here" - No Thanks! –  Mitch Wheat Feb 4 '12 at 6:24
    
do it as soon as possible else google also blacklist your website –  rahularyansharma Feb 4 '12 at 6:29
    
and u have to remove that script manually from every web page bottom –  rahularyansharma Feb 4 '12 at 6:30
5  
I would suggest removing the affected system from the network, performing a post-mortem on the affected system to determine how the infection occoured, and then formatting, reinstalling and restoring from a known good backup. –  Crippledsmurf Feb 4 '12 at 6:32
    
You might want to review your wordpress plugins and build version. It is often the weak point if only because there are well known exploits and so many people are running it that there are lots of kiddie scripts targeting wp –  Ben D Feb 4 '12 at 6:37

1 Answer 1

Delete everything, reinstall the developer's own computer, then reinstall your servers from the OS level up and restore from a clean backup. That's all there is to it, really. At this point don't even bother trying to remove just the virus, you've clearly found that to be beyond your abilities; just wipe everything clean and start from a known-good state.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.