Malware On Web Site - How To Get Rid Of It?

[MRM4TN]

First of all, let me say this is not a web site currently hosted by TCH. Someone I know maintains a web site and says he's getting a number of complaints saying his web site has some sort of malware embedded in the site. I went there and nothing came up for me. How does a person detect and then get rid of any malware that's embedded in a web site?

[TCH-Bruce]

Most malware hacks on a website is cause by bad or out of date scripts being run. They are usually done with SQL injection techniques. Google for SQL injection and you will find plenty of useful information. Another possibility can be caused by the version of web server software being run. Just like scripts that get hacked web server software should be patched with security updates. I'd have them contact support where they are hosted and have them check into it.

[SteveW]

If Google has detected the malware, the site will probably be flagged in Google search results with "This site may harm your computer". If/when that happens, you can use the "Google Safe Browsing diagnostic page" for the site to help figure out some things about the malware that was found. Also, the webmaster can go into their Google Webmaster Tools account, which provides them additional information.

 

On a compromised site, it is common for some people to get a virus warning and others not to get one, for several reasons. Sometimes, the malware is only served if the referer string shows that the visitor came from a Google or other search page. Or, often the malware is only brought into the browser when JavaScript is enabled; a visitor with JS enabled will get a virus warning, while a visitor with JS disabled will likely not.

 

There are several online tools for scanning pages of a web site for suspicious iframes or JavaScript embedded in the code. Two of them are UnmaskParasites and Dasient WAM.