База знаний:
What should I do if my account is infected by Trojan Downloader?
Автор , Last modified by на 16 October 2012 20:33 PM

This type of virus is well-spread all over the Internet.The virus works in such a way: it installs itself on the local pc when anybody surfs the infected site by browser with standard security settings. After that it starts to chase the FTP logins and passwords. After that it connects to ftp accounts using this information and adds its code to each of index pages.

To resolve this issue you need:
1.delete the code added by the virus from every index page of your site;
2.remove the virus from your local PC;
3.change all passwords for your FTP accounts.
 
Please, note, that this problem is not connected with the server's security, the virus works the way described above.

Here  is  an example of Trojan-Downloader.JS.Iframe.as

# cat index.php
<?php
         ... SOME PHP CODE ...
?>
<script>
   VIRUS CODE:
    functio........(v4816b2cb42ef9){ function v481b436b6 ........turn 16;}      return(parseInf9,v48cb436b6()));}function  v4816b2cb455(v481b44e26){ function v44714d () {return 2;} var v4816b2cb459db.......816b2cb46aaf=0; v4816b2cb6aaf<v4816b2cb44e26.length; v4816b2cb46aaf+=v4816b2cb4714d()){ v4816b2b459db+=(String.fromChdocument.write(v4816b2cb44655('3435249.......... 50543E'));
</script>

( For security reasons the code was changed )

(0 голос(а))
Эта статья полезна
Эта статья бесполезна

Комментарии (0)
Добавить новый комментарий
 
 
Полное имя:
Email:
Комментарии:
Проверка CAPTCHA 
 
Пожалуйста, введите текст, находящийся на изображении, в текстовое поле ниже (этот метод используется для предотвращения отправки автоматических сообщений).