Whats the problem ?
Thousands of websites are being attacked on daily basis. Malicious code is being injected in PHP, Javascript and HTML scripts. Website users are downloading malicious code and infecting others.
Who is compromised?
Your computer is compromised, don't blame you hosting company for this.
How does it work ?
When you open a website (most probably in IE) which is infected with malicious code, your browser downloads malicious code (which is a trojan/spyware) from the URL specified in the iframe tag or in the source of a script tag ( some times your browser also opens Acrobat Reader). Most of the anti-viruses don't detect this trojan, some only give a warning but don't block it. So when your computer is infected, a trojan residing in your computer steals your ftp passwords when you type them in your ftp program. Using these ftp accounts, the trojan scans all the directories on your ftp server and find files having any of following words in their name
- main
- default
- index
- home
- and all the files included at the top of index file
The trojan then injects malicious code into these files and also infects the users visiting your website.
Are you also infected?
To check to see if your computer is infected. You can download
HijackThis the free utility from TrensSecure's website.
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis
HijackThis is a utility which quickly scans your Windows computer to find settings that may have been changed by spyware, malware or other unwanted programs. HijackThis creates a report, or log file, with the results of the scan.
After you have downloaded and performed a scan, locate the highligted entry shown in the image below
Click Here for full preview image
There could be other suspecious entries indicated by HijackThis, but the above entry is sure shot trojan which is infecting you websites.
How to remove this trojan?
- Update your adobe acrobat reader, never use a version of Acrobat Reader less than 9.3.1
- Update your flash player, use the latest version 10 of flash browser plugin
- Scan your computer with MalwareBytes (http://www.malwarebytes.org/). If you are unable to run a scan of MalwareBytes, this is beacuse of the malware, You should consider reinstalling your os
-
Fix all the suspecious entries indicated by HijackThis. If you find an entry ending with AcroIEHelper.dll then you computer is definitly infected with the trojan. Fix this with HijackThis and also remmove AcroIEHelper.dll from your computer. This file will be located in the Acrobat Reader directory. After deleting this file restart your computer and again scan with HijackThis, if you again find this entry and you are unable to remove it. Then you should install a fresh copy of Windows.
Dániel Dékány