A few weeks ago I hired someone to build for me a very simple PHP site. I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of his tasks.

When the deadline was over (it was a really simple task), I contacted him to see some results and he asked me for more time. Finally, I realised that he was not able to do the task, so I told him that I didn't need his services anymore.

Today I accessed the site's main page just to look if I could use some of what he did, but my antivirus blocked me with an alert of some virus called VBS:Agent-KZ[Trj]. (See the image below).

I contacted my hosting provider and they told me that they did not detect anything.

My questions are:

  1. Do you think this guy did something with the goal of harming me?
  2. How can this virus harm me? How dangerous is it?
  3. I am concerned about my email password, because I was logged in my Gmail account in a different tab while I tried to access the site. Should I change my password?

I would appreciate your advice on my problem. Have a look at the image below to see the antivirus warning.

enter image description here


I am struggling with this issue, so far this is what I did:

  1. I contacted the company, but they keep saying to me they find nothing in my documents root. I am sceptical about this, because since it is a shared hosting, I think the virus could be anywhere.

  2. I disabled the DNS server configuration from my GoDaddy admin panel, so if somebody goes to that URL, they will not be infected.

  3. I scanned the whole infected system with Avast and I found a file called f3PSSavr.src in the System32 directory. I managed to erase it and currently I am performing a boot time scan also with Avast. I am curious what that was? And how it came there? I scan my systems for viruses at least once per month and this is new. You think it could come via the infected URL?

  4. My next step, once the boot scan in my laptop finishes, is to erase all the browsers cache.

So what do you think the processes is in order fix the issue?

  • "I am curious what that was? And how it came there? I scan my systems for viruses at least once per month and this is new. You think it could come via the infected URL?" - Malware, Exploit, you need to scan your system daily and have security software that updates at least every 4 hours.
    – Ramhound
    Commented May 25, 2012 at 16:22

3 Answers 3

  1. Perhaps - proving that the developer uploaded a "dropper" would be difficult. Considering that credentials were provided to the developer, it's possible that the credentials were passed-on or otherwise compromised (the developer's system could have already been compromised). Regardless, unless you wish to initiate legal action, focusing on the point that your site is compromised and working to clean it is more efficient.

  2. The "malware" can be harmful. The difference in term is that the dropper app that Avast detected is a way to gain access to your system. If the malware successfully compromised your system, then it's possible that an attacker have installed a backdoor. With that said, it looks like Avast detected the dropper so it's possible that the infection attempt was blocked.

You could always try running other malware detectors to see if your system has been compromised. Otherwise, if you know a good security practitioner, you could always have them take a look. I'd recommend against going to big-box computer stores - the workers there often have little knowledge or experience in this area (you get what you pay for).

Alternatively, if compromise is a concern, then reimaging the system and reinstalling software only from verified sources (i.e. media, vendor's web sites, etc) will reduce the likelihood that you become re-infected. Reinfections are common when people backup the binaries and re-install those on a clean system. Again, this measure is if you are certain that your system is compromised and you want greater assurance that your system is clean.

FYI, if you're interested in learning more about the dropper, look here for other names assigned to this app by other AV/malware vendors.

  1. YES! You should change your password immediately and while you're at it, make sure that no other apps have been authorized access, password recovery features aren't modified, etc. Any other sites that use the same password should also be a point of concern - change those password as well (i.e. banking, VPN, etc) - preferably to something that's different. Password managers (i.e. Lastpass, KeePass, etc) helps manage using multiple passwords for each account.

Good luck

  • I did change the password of my email and another few sites from a diferent computer that never accessed the infected URL. Now i am just worry about my personal laptop were i first time accessed that URL. I am performing a deep scan with AVAST, but i found nothing. You think this should be enough?
    – sfrj
    Commented May 24, 2012 at 11:18
  • Well, AVAST is one tool that scans for malware. There are many more options available including tools like Malwarebytes (I have no affiliation). A "better" method for scanning a system is to leverage a couple of different tools and perform a cold scan (i.e. boot to CD/DVD/USB boot disk and scan file system). This approach may identify any rootkit-based infections that may not be identified using an hot scan. With that said, your system might be <i>clean</i>. If anything, I'd recommend keeping an eye for any unusual behavior in the near term that could indicate something more nefarious.
    – bangdang
    Commented May 24, 2012 at 19:33
  • @sfrj - Your security software blocked the infection. At least that one particular infection. You will have to download the source files and figure out what infections are being dropped to visitors. You should disable the domain after you download the files, and you figure out what has happen. My guess the reason this happen is because you hired somebody that wasn't up for the task. He unlikely did it himself, he really shouldn't have required access to your account, if he was.
    – Ramhound
    Commented May 24, 2012 at 20:08
  • @Ramhound You are right, i want to know what was it, but i am afraid of getting infected again in the process. There is many sensitive data in my systems and i don't know how to download that in a save way. I don't have linux in any of my systems. Since the hosting was not very expensive, i thought about just disable the domain and focus in cleanig the infected system.
    – sfrj
    Commented May 25, 2012 at 9:10
  • @sfrj - You understand that uploading sensitive data to a share hosting is a major security problem right? The criminal who infected your hosting account likely has/had access to those files also.
    – Ramhound
    Commented May 25, 2012 at 15:15

Assuming you still have credentials to log into the hosting site, log in and download the files, then delete them from the server. You, or another, can look through the files to find trojans or code in the pages that reference external sites that might be the source of the files.

Then change your passwords to the site, email, etc, if you have not already.

If your anti-virus caught the trojan, then it hasn't infected you. What you should be looking for is other viruses that your AV might NOT have caught. Looking through the files and code of the site will make that easier and will be more definitive.

I hope that helps.

  • I don't know should i do that, i emailed the company and i supose they are working on it.
    – sfrj
    Commented May 24, 2012 at 11:25
  • @sfrj - You need to do it so YOU KNOW it was actually down. The hosting business doesn't care they will simply deactive your account easier for them.
    – Ramhound
    Commented May 24, 2012 at 20:11
  • @Ramhound I will do that, just i need to find somebody to help me with that, because i do not have experience with PHP hostings. One thing i did, to avoid infections was disable the DNS servers from my godady admin panel, so nobody can go to that URL. I think meanwhile could be a good solution.
    – sfrj
    Commented May 25, 2012 at 8:54

well ...its better to expect the worse scenario and think that the guy (or someone else ) is trying to harm you on purpose, in that case he might install what called a "downloader" on the website which will download a trojan horse on your computer ...

I have googled the virus's name yet i had no good answer, so im not sure what this virus does , my advice :

1- change every every password that was previously saved on you computer FROM ANOTHER PC

2- try to log into your account from a Linux system , the virus will be paralyzed and harmless there (actually its better to do step 1 from here)

3- contact the hosting company again and tell them about the whole story with virus's name or the screenshot

4- run a full scan over your PC just to make sure that its was the only threat

good luck...

  • this is the virus description: fortiguard.com/av/VID2143453
    – schroeder
    Commented May 24, 2012 at 0:53
  • @schroeder Oh No! this one is scary, he could even take my keystrokes. I did change my passwords and also i run a full system scan(nothing found). Regarding to the hosting, i am letting the company handle this, so i did not change the hosting password.
    – sfrj
    Commented May 24, 2012 at 11:23
  • @sfrj - You need to change the hosting password. You need to assume your system is infected until you can determine what other infections were attempting to be spread to vistors of your website.
    – Ramhound
    Commented May 24, 2012 at 20:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .