Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A few weeks ago I hired an outsourcer from India to build for me a very simple PHP site. I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of his tasks.

When the deadline was over (it was a really simple task), I contacted him to see some results and he asked me for more time. Finally, I realised that he was not able to do the task, so I told him that I din't need his services anymore.

Today I accessed the site's main page just to look if I could use some of what he did, but my antivirus blocked me (See the image below).

So in there there is some virus called VBS:Agent-KZ[Trj].

I contacted my hosting provider and they told me that they did not detect anything.

My questions are:

  1. Do you think this guy did something with the goal of harming me?
  2. How can this virus harm me?, How dangerous it is?
  3. I am concern about my email password, because i was logged in my Gmail account in a different tab while I tried to access the site. Should I change my password?

I would appreciate your advice on my problem. Have a look at the image below to see the antivirus warning.

enter image description here

Update

I am struggling with this issue, so far this is what i did:

1- I did contact the company, but they keep saying to me they find nothing in my documents root. I am sceptic about this, because since it is a shared hosting i think the virus could be anywhere.

2- I dissabled the DNS server configuration from my www.godaddy.com admin panel, so if somebody goes to that URL, he she will not be infected.

3- I Scanned the hold infected system with AVAST and i found this: A file called f3PSSavr.src in the System32 file. I managed to erase it and currently i am performing a boot time scan also with AVAST. I am curious what that was? And how it came there? I scan my systems for viruses at least once per month and this is new. You think it could come via the infected URL?

4- My next step once the boot scan in my laptop finishes is to erase all the browsers cache.

So what do you think you think i am going in the correct way to fix this?

share|improve this question
2  
you can still see the domain name in the error page .... –  schroeder May 24 '12 at 0:35
    
@schroeder Ups mistake, Thanks i didn't want to show the domain name to avoid other people getting infected –  sfrj May 24 '12 at 11:09
    
"I am curious what that was? And how it came there? I scan my systems for viruses at least once per month and this is new. You think it could come via the infected URL?" - Malware, Exploit, you need to scan your system daily and have security software that updates at least every 4 hours. –  Ramhound May 25 '12 at 16:22
add comment

3 Answers

up vote 3 down vote accepted
  1. Perhaps - proving that the developer uploaded a "dropper" would be difficult. Considering that credentials were provided to the developer, it's possible that the credentials were passed-on or otherwise compromised (the developer's system could have already been compromised). Regardless, unless you wish to initiate legal action, focusing on the point that your site is compromised and working to clean it is more efficient.

  2. The "malware" can be harmful. The difference in term is that the dropper app that Avast detected is a way to gain access to your system. If the malware successfully compromised your system, then it's possible that an attacker have installed a backdoor. With that said, it looks like Avast detected the dropper so it's possible that the infection attempt was blocked.

You could always try running other malware detectors to see if your system has been compromised. Otherwise, if you know a good security practitioner, you could always have them take a look. I'd recommend against going to big-box computer stores - the workers there often have little knowledge or experience in this area (you get what you pay for).

Alternatively, if compromise is a concern, then reimaging the system and reinstalling software only from verified sources (i.e. media, vendor's web sites, etc) will reduce the likelihood that you become re-infected. Reinfections are common when people backup the binaries and re-install those on a clean system. Again, this measure is if you are certain that your system is compromised and you want greater assurance that your system is clean.

FYI, if you're interested in learning more about the dropper, look here for other names assigned to this app by other AV/malware vendors.

  1. YES! You should change your password immediately and while you're at it, make sure that no other apps have been authorized access, password recovery features aren't modified, etc. Any other sites that use the same password should also be a point of concern - change those password as well (i.e. banking, VPN, etc) - preferably to something that's different. Password managers (i.e. Lastpass, KeePass, etc) helps manage using multiple passwords for each account.

Good luck

share|improve this answer
    
I did change the password of my email and another few sites from a diferent computer that never accessed the infected URL. Now i am just worry about my personal laptop were i first time accessed that URL. I am performing a deep scan with AVAST, but i found nothing. You think this should be enough? –  sfrj May 24 '12 at 11:18
    
Well, AVAST is one tool that scans for malware. There are many more options available including tools like Malwarebytes (I have no affiliation). A "better" method for scanning a system is to leverage a couple of different tools and perform a cold scan (i.e. boot to CD/DVD/USB boot disk and scan file system). This approach may identify any rootkit-based infections that may not be identified using an hot scan. With that said, your system might be <i>clean</i>. If anything, I'd recommend keeping an eye for any unusual behavior in the near term that could indicate something more nefarious. –  bangdang May 24 '12 at 19:33
    
@sfrj - Your security software blocked the infection. At least that one particular infection. You will have to download the source files and figure out what infections are being dropped to visitors. You should disable the domain after you download the files, and you figure out what has happen. My guess the reason this happen is because you hired somebody that wasn't up for the task. He unlikely did it himself, he really shouldn't have required access to your account, if he was. –  Ramhound May 24 '12 at 20:08
    
@Ramhound You are right, i want to know what was it, but i am afraid of getting infected again in the process. There is many sensitive data in my systems and i don't know how to download that in a save way. I don't have linux in any of my systems. Since the hosting was not very expensive, i thought about just disable the domain and focus in cleanig the infected system. –  sfrj May 25 '12 at 9:10
    
@sfrj - You understand that uploading sensitive data to a share hosting is a major security problem right? The criminal who infected your hosting account likely has/had access to those files also. –  Ramhound May 25 '12 at 15:15
show 4 more comments

well ...its better to expect the worse scenario and think that the guy (or someone else ) is trying to harm you on purpose, in that case he might install what called a "downloader" on the website which will download a trojan horse on your computer ...

I have googled the virus's name yet i had no good answer, so im not sure what this virus does , my advice :

1- change every every password that was previously saved on you computer FROM ANOTHER PC

2- try to log into your account from a Linux system , the virus will be paralyzed and harmless there (actually its better to do step 1 from here)

3- contact the hosting company again and tell them about the whole story with virus's name or the screenshot

4- run a full scan over your PC just to make sure that its was the only threat

good luck...

share|improve this answer
    
this is the virus description: fortiguard.com/av/VID2143453 –  schroeder May 24 '12 at 0:53
    
@schroeder Oh No! this one is scary, he could even take my keystrokes. I did change my passwords and also i run a full system scan(nothing found). Regarding to the hosting, i am letting the company handle this, so i did not change the hosting password. –  sfrj May 24 '12 at 11:23
    
@sfrj - You need to change the hosting password. You need to assume your system is infected until you can determine what other infections were attempting to be spread to vistors of your website. –  Ramhound May 24 '12 at 20:10
    
who know, maybe you be part of the next big ddos (half-of-a-joke) –  happy Jan 2 '13 at 5:53
add comment

Assuming you still have credentials to log into the hosting site, log in and download the files, then delete them from the server. You, or another, can look through the files to find trojans or code in the pages that reference external sites that might be the source of the files.

Then change your passwords to the site, email, etc, if you have not already.

If your anti-virus caught the trojan, then it hasn't infected you. What you should be looking for is other viruses that your AV might NOT have caught. Looking through the files and code of the site will make that easier and will be more definitive.

I hope that helps.

share|improve this answer
    
I don't know should i do that, i emailed the company and i supose they are working on it. –  sfrj May 24 '12 at 11:25
    
@sfrj - You need to do it so YOU KNOW it was actually down. The hosting business doesn't care they will simply deactive your account easier for them. –  Ramhound May 24 '12 at 20:11
    
@Ramhound I will do that, just i need to find somebody to help me with that, because i do not have experience with PHP hostings. One thing i did, to avoid infections was disable the DNS servers from my godady admin panel, so nobody can go to that URL. I think meanwhile could be a good solution. –  sfrj May 25 '12 at 8:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.