Website infected!!

kokobrown 16 1.9k Scotland
15 Oct 2009 11:06PM
Hey guys,

Got a really annoying problem and hope someone can help me! Google is listing my website as inefected and its been like that for months apparently?

In the listings in google its got under the heading lots of random jumbled up letters...strange... and it seems after you click on my name in the intro.. very quickly down the bottom you seem to see another website its loading to?

Ive taken all the files from my FTP and scanned with bullguard and microsoft essentials.. but nothing found? This is really starting to piss me off as I have no clue how to fix it!!!!!!

ANY help greatly appreciated!!!


Join ePHOTOzine for free and remove these adverts.

looboss 13 3.1k 7 United Kingdom
15 Oct 2009 11:08PM
I would speak to your hosting provider, it may not be just your site but their servers????
kokobrown 16 1.9k Scotland
15 Oct 2009 11:14PM
Spoke to 1&1 and they confirm not their servers and told me to download all my ftp stuff, scan it and check that way..not finding anything but there is defo something there!!
Pete Plus
19 18.8k 97 England
15 Oct 2009 11:32PM
Do you understand the code on your web site pages? Reason I ask is some hackers have the ability to add code to a page if they manage to get through to your server via a hole left by either you in some code or by someone else if you're using shared servers. It happened to me and I got infected on my personal site's index page.
kokobrown 16 1.9k Scotland
15 Oct 2009 11:37PM
Nope, no clue about that sorta thing?

I did build the site myself but very basic design in photoshop, chop it up in image ready and thats it!

Pete Plus
19 18.8k 97 England
15 Oct 2009 11:42PM
Send me the index page and I'll have a look...will be either index.html or index.php
Pete Plus
19 18.8k 97 England
15 Oct 2009 11:52PM
Or, if you can view the index a plain text editor such as notepad or word pad and look for a chunk of javascript.

It will look like this at the beginning then the function follows with function hilbnb25(z) the hilbnb bit might be a different set of charachters on your page but it always seems to follow with (z) Next is {var c=z.length,m=1024 and then a huge string of letters and numbers ending with
If you take all this out the problem is resolved. Back up just in case you make a mistake.
User_Removed 16 17.9k 8 Norway
16 Oct 2009 8:35AM
Bookmarking for future reference.
Pete Plus
19 18.8k 97 England
16 Oct 2009 9:19AM
Go it but my system doesn't want to let it through so I can confirm it's definitely the thing I talk about (a trojan). You need to replace that page with an unaffected back up, or if you can get in and edit remove the affected area. The hacker could also have affected some other pages.

As your system doesn't seem to be able to spot the problem I suggest you also get a better virus detector. I'm using Avast and it's really good at this sort of stuff...and free!
Once installed so a full system scan and it will pick up if any of the other pages are a problem. When I had the same problem it affected headers and footer include files (which I suspect you don't have) and a few more index type pages within the site.

Make sure you have removed the damaged file from your computer too delete and empty trash can.

How did it happen? Either some of your code, (or some someone else, if you have a shared server) gave a route into the system. I suggest you change your FTP password. Also if the same ftp password is used elsewhere change that too.
kokobrown 16 1.9k Scotland
16 Oct 2009 1:41PM
Thanks for all the help!

Will be changing all my passwords when I get home!

I think perhaps a reformat for the desktop and laptop is on the cards!!!

kokobrown 16 1.9k Scotland
16 Oct 2009 6:55PM

Had a look through all my html files and there ALL infected with some dodgy code!!

I think this is the bad bit - correct me if im wrong?

EDIT: hmm bit i tried to type in isnt working.. anyway it goes something like.. efesekerleme. com php and all that stuff??

What the heck is it?

put spaces in it just in case!!

csurry 18 9.2k 92
16 Oct 2009 6:59PM
You can't paste HTML code directly as the upload will try to interpret it.

You'll need to remove some of the formatting if you want to show people.
kokobrown 16 1.9k Scotland
16 Oct 2009 7:02PM
Thanks Cheryl!

Been a very bad day today!
csurry 18 9.2k 92
16 Oct 2009 7:05PM
Can imagine.

Suggest you edit out what you think is the issue and then just post a single page back to your site and see if it behaving now.

If you need a quick web presence can I suggest take up the 30 day trial from Photium while you sort this out. It won't take you long to get it up and running and you should be able to get soeone to help you get a re-direct from your normal address to the Photium site until you get yourself up and running again. Otherwise you may miss out on some business.
kokobrown 16 1.9k Scotland
16 Oct 2009 7:15PM
Yes, bad day...neighbour woke me up at half 6..shes just moving in and decided it was the perfect time to shout down stairs to the repair man, our walls are very badly soundproofed! Then spent fecking ages trying to delete this code and figure it out..missed the train for work.. my expenses didnt go into my account.. then i find out my gran has more than likely got lung cancer - really really not a good day at all..shuda stayed in bed!!

Sign In

You must be a member to leave a comment.

ePHOTOzine, the web's friendliest photography community.

Join For Free

Upload photos, chat with photographers, win prizes and much more.