Welcome to Australia's only Vintage Radio and Television discussion forums. You are not logged in. Please log in below, apply for an account or retrieve your password.
Australian Vintage Radio Forums
  Home  ·  About Us  ·  Discussion Forums  ·  Glossary  ·  Outside Links  ·  Policies  ·  Services Directory  ·  Safety Warnings  ·  Tutorials

General Discussion

Forum home - Go back to General discussion

 Had a trojan at my web site, think I got rid of it
« Back · 1 · Next »
 Return to top of page · Post #: 1 · Written at 2:20:13 PM on 15 February 2013.
Wa2ise's avatar
 Location: Oradell, US
 Member since 2 April 2010
 Member #: 643
 Postcount: 830

I, and a number of others, were getting warnings when trying to access my web site http://www.wa2ise.com for the last couple of weeks. I FTPed to my web host, and according to the dates at the ftp site, something happened to all my html files on Jan 20, 2013 around 9PM. I copied the index.html file to my 1st computer (I have MacFee SW on it), it reports that it found, then removed a Trojan embedded in this file. As a test, I copied this cleansed file back to the web host, and tried on my 2nd computer (running Norton) to look at my web site. It used to be rejected, now it loads as normal.

Then I did the rest of the html files, and when I copied the various html files to my computer, McAfee says it found a trojan in each file, and removed it from each file for me. I then copied these "cleansed" files back to the web site via ftp, and my 2nd computer, which used to deny access to my web page, now doesn't get upset, and it now loads as normal.

So give my web site another try. Looks like the trojan is gone, I hope...


 
 Return to top of page · Post #: 2 · Written at 2:53:17 PM on 15 February 2013.
GTC's avatar
 GTC
 Location: Sydney, NSW
 Member since 28 January 2011
 Member #: 823
 Postcount: 6687

If you still have a copy of any of the infected files it might be interesting to upload it to VirusTotal and see what the suite of virus checkers make of it:

https://www.virustotal.com/


 
 Return to top of page · Post #: 3 · Written at 2:16:01 AM on 16 February 2013.
Wa2ise's avatar
 Location: Oradell, US
 Member since 2 April 2010
 Member #: 643
 Postcount: 830

Found another problem, this one my mistake: I uploaded the wrong index.html file to my web site's root directory. But I corrected that this morning USA time.

Looked at the MacAfee logs, and it says that trojan was this:
JS/Exploit-Blacole.gc


 
 Return to top of page · Post #: 4 · Written at 10:23:56 PM on 18 February 2013.
Airzone's Gravatar
 Location: Maclean, NSW
 Member since 30 May 2008
 Member #: 291
 Postcount: 341

For those running Norton Internet Security, there is a glitch (Error Message 8504, 104) which disables this program recently. You have to go to the Symantec web site and load the patch. I have caught this recent Trojan 3 times with Norton. Others were not so lucky.
If you do not have a good anti-virus program fully updated daily you leave yourself open to attack. No anti-virus is 100% safe against the bad guys.


 
 Return to top of page · Post #: 5 · Written at 11:54:09 PM on 18 February 2013.
GTC's avatar
 GTC
 Location: Sydney, NSW
 Member since 28 January 2011
 Member #: 823
 Postcount: 6687

I use Avast! (the paid-for version). It has saved my bacon on many occasions.


 
« Back · 1 · Next »
 You need to be a member to post comments on this forum.

Sign In

Username:
Password:
 Keep me logged in.
Do not tick box on a computer with public access.