Hello, sorry to put this here but couldnt think of a relevant section.

 

This is something i have yet to come across in my web design progress but its now faced me on my own site.

 

I have been running a ecommerce store for about a year and last week a couple of people were reporting that norton was picking up a virus on it.

 

I was working on a new site anyway so i went ahead and deleted all the files off my server.

 

I have recently started using opencart and today i had a message apear on safari saying suspected malware.

 

Where do i go from here?

 

EDIT: the page it says is: ctolfpcqldrvxvml.ru

 

I think thats what the google diagnosis page is saying :/

 

I have searched my server files and cant find that file...

Edited June 20, 201214 yr by Lovelock

Someone is redirecting your website to ctolfpcqldrvxvml.ru.

 

http://en.reddit.com/r/netsec/comments/v9s8z/so_i_think_this_guy_got_his_website_hacked_there/

 

Check with your host?

Thanks, just speaking to them now.

 

How do i go about preventing this sort of thing in the future?

To be honest, I have no idea about web security. I assume it's a problem with your host, so maybe look at changing?

 

But somebody on here will have a better idea, I'm sure

To be honest, I have no idea about web security. I assume it's a problem with your host, so maybe look at changing?

 

But somebody on here will have a better idea, I'm sure

 

Yeah i understand, is one of those things that hasnt crossed my mind.

 

Am submitting a report to them now and shall see what there response it...

Get in touch with your host and speak to them.

 

I once had this issue on a reseller hosting account, so I basically set a new hosting profile up in my account and re-uploaded my files, and deleted the infected account, and that sorted it for me, but obviously the first thing is to speak to your host.

 

Good luck.

The norton report should tell you which file is causing the issue so check this first .

Just waiting for the reply back from the host.

 

Im using a mac so i dont have norton or anything, unless someone one on here fancied seeing what the page says?

 

However it is now not saying any problems so am slightly confused...

PM me a link and i'll have a look.

The main problem is http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Trojan%3aJS%2fBlacoleRef.BG&threatid=2147657687

 

Although there's no actual file listed so it should be something to do with the server rather than an actual file.

 

Wait for your hosting company to get back to you as it should really be their problem.

So i got this reply from the host:

 

The site Sucuri.net does indicate that you "catalog" application has been injected with malicious code:

 

http://sitecheck.sucuri.net/results/vinylpenguin.co.uk

 

It may be worth running a restore (or reupload) your catalog files from before the hack date.

 

After checking what the sucuri report said it showed infections in the js folder.

 

So im currently making a back up of the js folder, then im going to upload the original and see how that goes.

 

My question it, whats to stop this happening next week all over again...?

Theres no real way to stop it but prevention is the key. Looks like they gained access to your account and im guessing only your account as the host would of said "The server was breached etc..". You can just be sure to have good strong passwords.

 

Also do regular back ups. And hope you notice the problem before the back up file is backed up and rewritten. But saying that your host should have backed up files if they offer daily back ups and should be able to download and upload a back up from before the hack.

 

If you are using a shared hosting account it would be down to the host to make sure the sever is safe from crackers and hackers. If you have your own VPS think about getting it hardened by a server company.

Got this sorted... for now!

 

I downloaded the old js folder and saved it as a back up. Then re uploaded the old files.

 

But this was still throwing up warnings...

 

Turned out i hadnt uploaded the old ones, but re uploaded the same ones haha.

 

So finally uploaded the old ones and its all coming back clean.

 

Shall change passwords and see what happens.

 

Thanks for the help people!

I have had a number of OpenCart sites that have been injected. TBH you really need to go through the majority of your core files and look for/delete anything that looks suspicious. Most often it will be obfuscated, which means it will look like loads of random code in your html/php files.

 

Use this website to help you detect them: http://redleg-redleg.com/file-viewer/

 

Once you have found them and deleted them make sure you change ALL your passwords for the site including ftp & admin logins.

 

Also make sure to look in the .htaccess file(s) for any code that you know you have not put in there youself, as this may enable the "hack" to re-establish itself via a backdoor vulnerability.

 

Good luck & I hope this helps.

Edited June 21, 201214 yr by Bomb

I would delete and re-upload everything, if I was you. Be 100% safe.