Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite
1

I recently started getting this really weird problem where a virus seems to pop up as frequently as once a week in my site. It is running on BlogEngine and basically what happens is this:

  • A bunch of .PHP files start appearing in my site folders
  • It appends an iFrame in my page that links to a page countXX.php, where XX is a random number

Sucuri.net listed the virus as MW:EXPLOITKIT:BLACKHOLE1, and said it is one of the most common viruses circling the net as of lately. This has more information.

Please does anyone know how I can protect my website against this? It is wasting me a lot of time.

share|improve this question
1  
Have you changed all your passwords related to the web site, also your email password? – Henning Klevjer Dec 8 '12 at 14:33
No, should I? I don't think they have the passwords because I never actually found any of my posts to have changed. – TheGateKeeper Dec 8 '12 at 15:15
1  
If your web site is compromised, and stays compromised, it is likely that they have credentials for logging on to your site's "control panel", and may upload their exploits on your domain. Note however that you may have malware on your computer also, which is collecting your website credentials from your computer. IMO you should at least change your site information. Also, your host may have some information on when your site was accessed and how the exploit kit ended up on your site. You might want to check that out and discuss it with your host. – Henning Klevjer Dec 8 '12 at 15:40
1  
You should hire a professional. – Rook Dec 8 '12 at 17:21
2  
@TheGateKeeper - Nothing you can look for will tell you anything helpful. It won't help you locate these criminals, the very most you can hope for, is figure out how they are uploading the file. But you already know that is happening its either an exploit in the software your using or they knew your username/password.** I already validate all of my query string input.** - Sounds like this is the problem your using string input for your queries. – Ramhound Dec 10 '12 at 12:50
show 2 more comments

closed as too localized by Rook, Scott Pack, Mark Davidson, Iszi, AviD♦ Dec 11 '12 at 14:45

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.

1 Answer

up vote 1 down vote

You need to blow away the site and start from scratch. They have gained access to your server and changed files. You have no idea how far they have gone, which means "it is not your computer any more". It is very possible that they have replaced various files, which will make it possible from them to maintain access even if you change passwords.

Take down the site, re-install whatever binaries you use, then re-upload your files from a known-good source. Anything less is no guarantee that you can keep them from using a backdoor.

Your code also needs to be reviewed for vulnerabilities by someone qualified to do so. Yes, the comment and email fields are a way for attackers to gain access to your server if those fields are not properly coded.

share|improve this answer
1  
+1 The time spent completely re-installing is much better than time lost on failed attempts and uncertainty. – Justin C Dec 10 '12 at 18:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.