恶意软件/病毒雷在网站上便宜太阳镜

Question

I have a problem with a malware/virus that i have found on a website that i manage. I have not found any solution online, I hope that You can help me.

First of all, this virus had inserted on the homepage this block of code:

<div id="urlss-20140430-01" style="/* display: none; */">
<strong>
<a href="http://www.careertechnj.org/bans.php" title="cheap ray ban sunglasses">ray ban outlet</a>
<a href="http://technainstitute.com/wsunglass.php" title="cheap oakley sunglasses">cheap oakleys</a>
<a href="http://www.conama.org/code.php" title="oakley sunglasses cheap">oakley outlet</a>
<a href="http://ciocp.ro/fake.php" title="ray ban sunglasses sale">ray ban sale</a>
<a href="http://www.quadrifoglio.org/cheap.php" title="ray ban sunglasses cheap">ray bans cheap</a>
</strong></div>

Moreover, there is a file that generate continuously a file "cheap.php" that contain a row of code that get the contents of a website that advertises ray ban sunglasses.

If a try to cancel this generated file, after a second the file is generated again.

In addition, some of the files that were on the server, have been eliminated. But I do not know if this depends by the same virus.

Have you ever stumbled across this malware?

Please help me.

Thanks

Answer 1

It can be difficult to find the cause if your server has been compromised depending on the level of sophistication. You can use a service like sucuri, they have a free scanner on their homepage and will clean your site for you if your willing to pay.

Alternatively if you have all of your source code hosted somewhere else (maybe a local copy) you could delete all of your files and re-upload them. Even better would be to change server or web host to ensure peace of mind.