Options

iframe inserting into webpages

This happens for the following files:
index , default

A simple way to check is to see the FTP - directory structure.
Check for modified dates and you can know when there was the latest unknown modifications in pages not done by the owner.

Now this trojan works like it steals ftp URL, login and password when you login through your FTP client . Then after some time it goes and updates the files ( inserting unwanted iframe - usually at the bottom of the page) .

The simplest way to deal with this is : Just change the ftp password from the CPanel , everytime you are done with using ftp connection from ftp client.

Now for the one time action of cleaning your web directory , when you download the infected files, antivirus ( i tried avg - latest updated ) detects it. But then I do expect you have a back up . So just download all the suspected files into your workstation ( dummy foldes ) and quarantine-delete these files ( antivirus will promt you in case of infection ). Upload uninfected files once again .
There could be some files which are not part of your directory and purely a virus file (eg. default )
Change the FTP password .

No virus infection would be there after this.

PS : Change ftp password ,everytime you login through ftp client (eg. filezilla )
Sign In or Register to comment.