Do I have a virus on my hosted site?

Question

A few weeks ago I hired someone to build for me a very simple PHP site. I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of his tasks.

When the deadline was over (it was a really simple task), I contacted him to see some results and he asked me for more time. Finally, I realised that he was not able to do the task, so I told him that I didn't need his services anymore.

Today I accessed the site's main page just to look if I could use some of what he did, but my antivirus blocked me with an alert of some virus called VBS:Agent-KZ[Trj]. (See the image below).

I contacted my hosting provider and they told me that they did not detect anything.

My questions are:

1. Do you think this guy did something with the goal of harming me?
2. How can this virus harm me? How dangerous is it?
3. I am concerned about my email password, because I was logged in my Gmail account in a different tab while I tried to access the site. Should I change my password?

I would appreciate your advice on my problem. Have a look at the image below to see the antivirus warning.

Update

I am struggling with this issue, so far this is what I did:

1. I contacted the company, but they keep saying to me they find nothing in my documents root. I am sceptical about this, because since it is a shared hosting, I think the virus could be anywhere.

2. I disabled the DNS server configuration from my GoDaddy admin panel, so if somebody goes to that URL, they will not be infected.

3. I scanned the whole infected system with Avast and I found a file called f3PSSavr.src in the System32 directory. I managed to erase it and currently I am performing a boot time scan also with Avast. I am curious what that was? And how it came there? I scan my systems for viruses at least once per month and this is new. You think it could come via the infected URL?

4. My next step, once the boot scan in my laptop finishes, is to erase all the browsers cache.

So what do you think the processes is in order fix the issue?

Answer 1

1. Perhaps - proving that the developer uploaded a "dropper" would be difficult. Considering that credentials were provided to the developer, it's possible that the credentials were passed-on or otherwise compromised (the developer's system could have already been compromised). Regardless, unless you wish to initiate legal action, focusing on the point that your site is compromised and working to clean it is more efficient.

2. The "malware" can be harmful. The difference in term is that the dropper app that Avast detected is a way to gain access to your system. If the malware successfully compromised your system, then it's possible that an attacker have installed a backdoor. With that said, it looks like Avast detected the dropper so it's possible that the infection attempt was blocked.

You could always try running other malware detectors to see if your system has been compromised. Otherwise, if you know a good security practitioner, you could always have them take a look. I'd recommend against going to big-box computer stores - the workers there often have little knowledge or experience in this area (you get what you pay for).

Alternatively, if compromise is a concern, then reimaging the system and reinstalling software only from verified sources (i.e. media, vendor's web sites, etc) will reduce the likelihood that you become re-infected. Reinfections are common when people backup the binaries and re-install those on a clean system. Again, this measure is if you are certain that your system is compromised and you want greater assurance that your system is clean.

FYI, if you're interested in learning more about the dropper, look here for other names assigned to this app by other AV/malware vendors.

1. YES! You should change your password immediately and while you're at it, make sure that no other apps have been authorized access, password recovery features aren't modified, etc. Any other sites that use the same password should also be a point of concern - change those password as well (i.e. banking, VPN, etc) - preferably to something that's different. Password managers (i.e. Lastpass, KeePass, etc) helps manage using multiple passwords for each account.

Good luck

Answer 2

Assuming you still have credentials to log into the hosting site, log in and download the files, then delete them from the server. You, or another, can look through the files to find trojans or code in the pages that reference external sites that might be the source of the files.

Then change your passwords to the site, email, etc, if you have not already.

If your anti-virus caught the trojan, then it hasn't infected you. What you should be looking for is other viruses that your AV might NOT have caught. Looking through the files and code of the site will make that easier and will be more definitive.

I hope that helps.

Answer 3

well ...its better to expect the worse scenario and think that the guy (or someone else ) is trying to harm you on purpose, in that case he might install what called a "downloader" on the website which will download a trojan horse on your computer ...

I have googled the virus's name yet i had no good answer, so im not sure what this virus does , my advice :

1- change every every password that was previously saved on you computer FROM ANOTHER PC

2- try to log into your account from a Linux system , the virus will be paralyzed and harmless there (actually its better to do step 1 from here)

3- contact the hosting company again and tell them about the whole story with virus's name or the screenshot

4- run a full scan over your PC just to make sure that its was the only threat

good luck...