A few weeks ago I hired someone to build for me a very simple PHP site. I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of his tasks.
When the deadline was over (it was a really simple task), I contacted him to see some results and he asked me for more time. Finally, I realised that he was not able to do the task, so I told him that I didn't need his services anymore.
Today I accessed the site's main page just to look if I could use some of what he did, but my antivirus blocked me with an alert of some virus called VBS:Agent-KZ[Trj]. (See the image below).
I contacted my hosting provider and they told me that they did not detect anything.
My questions are:
- Do you think this guy did something with the goal of harming me?
- How can this virus harm me? How dangerous is it?
- I am concerned about my email password, because I was logged in my Gmail account in a different tab while I tried to access the site. Should I change my password?
I would appreciate your advice on my problem. Have a look at the image below to see the antivirus warning.
I am struggling with this issue, so far this is what I did:
I contacted the company, but they keep saying to me they find nothing in my documents root. I am sceptical about this, because since it is a shared hosting, I think the virus could be anywhere.
I disabled the DNS server configuration from my GoDaddy admin panel, so if somebody goes to that URL, they will not be infected.
I scanned the whole infected system with Avast and I found a file called f3PSSavr.src in the System32 directory. I managed to erase it and currently I am performing a boot time scan also with Avast. I am curious what that was? And how it came there? I scan my systems for viruses at least once per month and this is new. You think it could come via the infected URL?
My next step, once the boot scan in my laptop finishes, is to erase all the browsers cache.
So what do you think the processes is in order fix the issue?