0

Possible Duplicate:
My server's been hacked EMERGENCY

I have a critical virus infection to one of my website.

There is a additional script found added at footer of few web pages . the pages are html pages. and all his index.php has a curl script added automatically which access some malicious code to be downloaded on people who view the website. The script is that much dangerous that it immediately destroys the accessing person system if there is no antivirus. The developer working on this website himself got 5 times system formatted in last 6 days.

Condition become more critical because the script keep on coming back after deleting from infected files. Now we are in worst condition that it has spread to all 8-10 websites developer is working on from last 6 months. BTW: we are using open source framework for developing these websites mainly we used Magento, CakePHP, wordpress.

IF YOU CAN HELP OUT ON THIS SUBJECT, PLEASE PROVIDE ANY OF YOUR PREVIOUS EXPERIENCE OR KNOWLEDGE TO HANDLE SUCH SITUATION.

All suggestions are appreciated.

P.S. If you guys need I can post the malicious script here which is added in my html and php files.

Edit: Is there any programming solutions to remove the added malicious code from website??

Improve this question
7
  • 3
    "I can post the malicious script here" - No Thanks!
    – Mitch Wheat
    Commented Feb 4, 2012 at 6:24
  • do it as soon as possible else google also blacklist your website
    – rahularyansharma
    Commented Feb 4, 2012 at 6:29
  • and u have to remove that script manually from every web page bottom
    – rahularyansharma
    Commented Feb 4, 2012 at 6:30
  • 5
    I would suggest removing the affected system from the network, performing a post-mortem on the affected system to determine how the infection occoured, and then formatting, reinstalling and restoring from a known good backup.
    – Crippledsmurf
    Commented Feb 4, 2012 at 6:32
  • You might want to review your wordpress plugins and build version. It is often the weak point if only because there are well known exploits and so many people are running it that there are lots of kiddie scripts targeting wp
    – Ben D
    Commented Feb 4, 2012 at 6:37

1 Answer 1

Reset to default
5

Delete everything, reinstall the developer's own computer, then reinstall your servers from the OS level up and restore from a clean backup. That's all there is to it, really. At this point don't even bother trying to remove just the virus, you've clearly found that to be beyond your abilities; just wipe everything clean and start from a known-good state.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .