I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website.

3 out of 6 people in the office have gotten viruses in the last week. Our IT consultant assures us that the virus would not be on the central server and that we all must have got it from the same website. Does that sound legitimate?

We now want to investigate to see if our website could be the source of the infection. What are the first steps into investigating the possibility that our website is infected?

  • But your website is on the central server, and your consultant says it is not from the central server. Why do you suspect your website, then? – schroeder May 1 '12 at 14:21
  • 1
    @schroeder In a way, I almost don't care why he suspects it. He's finding the root cause and reviewing his internal systems. That mindset goes miles in security as long it's paired with sane risk analysis. – Jeff Ferland May 1 '12 at 14:25
  • @JeffFerland Granted. But if the consultant is saying that the infection is not from a specific source, and the OP is wanting to focus on that very source, knowing why might help us be more efficient in our own root cause analysis. "When you hear hoof-steps, think 'horse' not 'zebra' " From the OP's text, it would seem to me that the common cause of infection was outside the company, either a website or an email. To focus on an internal server means there might be more to the story that we will need to hear. – schroeder May 1 '12 at 14:53

The best thing you can do is have a known clean copy of your site that you can compare the server's files against. Most hacked webservers that serve virus infections come from changing the content of scripting files that server is offering to clients. Look for files with different checksums or new files.

There are also cases with forums type sites where the infection will come through XSS. In an effort to hide infections from site owners, sometimes infections are only served up if the visitor has a referrer tag from a search engine in their request.

You can also run 3rd party scanners against your website. http://www.antihacksecurity.com/scan-a-website-for-virus-malware lists some of those options.

Since you're talking about your machines connected to the same server, I'm assuming you mean a LAN environment where that server also offers file sharing. Among other things, it's often very good practice to split servers that offer external facing services from those offering internal facing services. Further, that poses the idea that the server may have been compromised and then used as a launching point to infect your machines.

Identifying the particular infection will also allow you to research the most common way that it is transmitted. Most virus packages are full packages that an attacker can drop & move on. That means they'll behave the same way.

Ultimately, verification breaks down into two possible areas: scan try to find "bad stuff" or authoritatively certify that everything on your server is "good stuff." The second one is more secure, but requires the right type of environment and planning.

  • 1
    +1 for splitting the website from the central server. If that website is your main internet-facing website, you've GOT to move that to a DMZ and off your main server. If not, you're just letting the world into your company. – schroeder May 1 '12 at 14:23
  • Thanks this was a huge help. I've posted the results of my scan in another question security.stackexchange.com/questions/14474/… – Philip Kirkbride May 1 '12 at 15:16

You should use a firewall on your server to protect these kind of viruses coming from a website.Most of the times firewall can detect the viruses and discard them.And if there are certain cases where a virus can bypass the firewall in this case run an antivirus on each of the system to detect and remove the virus.

  • Thanks, I will keep this in mind. However we still want to investigate our own website, to protect our users. – Philip Kirkbride May 1 '12 at 13:52
  • 2
    A firewall will not normally inspect outgoing traffic from your website for viruses. Check to see if your firewall even has this capability. That said, firewalls are not the best at virus detection (they add a nice to have layer, but it's not dependable). – schroeder May 1 '12 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.