Website: how to check for infection?

[LDN]

A website I setup is apparently flashing a warning message in the browser for a couple of customers. I cannot recreate the issue... I have contacted the host to scan it and no issue found - and I'm also using Google webtools to see if anything comes up. I don't doubt the customers and so I do want to check on this.

Any other simple methods to check a website and if it harbours any nasties?

[sunbeam alpine]

Might be worth seeing if both customers have the same anti-virus (and which one).

[ryanthescot]

can you get any more detail about the message being shown? i'm going to guess it's just a javascript warning being shown to IE users.

[jonamv8]

What's the URL?

[anonymous-user]

Is the site https?

[wheelerc]

Go to https://www.virustotal.com/ and select 'URL' and enter your web address. I wouldn't post a link on here in case people click on it and get infected.

If you want to PM me the link I can take a closer look for you.

[LDN]

Thanks chaps; I'd rather not post the link just in case... thanks for the website test - I just did it and 0 infections found. If it were one visitor, I'd put it down to their browser being scew-iff... but there has been more than one report. For now, I'm satisfied but will dig a little deeper. Thanks again

[wheelerc]

Some viruses are very sneaky, and will only serve themselves up to say 1/10 visitors, and avoid serving themselves to known scanners, google's bots etc.

If you have command line access (SSH) to the server, you may be able to check for modified files, or run a scanner on the site files directly. These things can also be caused by infections at the server level, so it might be worth talking to whoever is hosting your site.

[LDN]

OK, so I have 7 websites - all on a shared server - they are all Wordpress; it seems that I did not stay on top of keeping them up to date. Upon researching the best security plugins; the concensus is WordFence is the best to scan and protect a WP site.

So I install Wordfence and 4 of the sites have red flags with the issues being the same:

• File appears to be malicious: wp-config.php

Filename: wp-config.php
File type: Not a core, theme or plugin file.
Severity: Critical
This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: "ZXZhbC". The infection type is: eval base64 encoded

• File appears to be malicious: wp-content/index.php

Filename: wp-content/index.php
File type: Core
Severity: Critical
This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: "ZXZhbC". The infection type is: eval base64 encoded

• File appears to be malicious: wp-content/plugins/index.php

Filename: wp-content/plugins/index.php
File type: Not a core, theme or plugin file.
Severity: Critical
This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: "ZXZhbC". The infection type is: eval base64 encoded

• File appears to be malicious: wp-content/themes/index.php

Filename: wp-content/themes/index.php
File type: Not a core, theme or plugin file.
Severity: Critical
This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: "ZXZhbC". The infection type is: eval base64 encoded

I now have to investigate this ZXZhbC thing and look how to clean...

[anonymous-user]

LDN said:

OK, so I have 7 websites - all on a shared server - they are all Wordpress; it seems that I did not stay on top of keeping them up to date. Upon researching the best security plugins; the concensus is WordFence is the best to scan and protect a WP site.

So I install Wordfence and 4 of the sites have red flags with the issues being the same:

I must say I use wordfence on a couple of wordpress installations and it seems to work well.

Should be a fairly straight forward job to clean up the infected PHP to put it right.

On my main website I use a daily scan by www.quttera.com which also seems to work well.

[LDN]

EddieSteadyGo said:

LDN said:

OK, so I have 7 websites - all on a shared server - they are all Wordpress; it seems that I did not stay on top of keeping them up to date. Upon researching the best security plugins; the concensus is WordFence is the best to scan and protect a WP site.

So I install Wordfence and 4 of the sites have red flags with the issues being the same:

I must say I use wordfence on a couple of wordpress installations and it seems to work well.

Should be a fairly straight forward job to clean up the infected PHP to put it right.

On my main website I use a daily scan by www.quttera.com which also seems to work well.

Yes wordfence; it's great! I'm very impressed. Thanks for the tip on the daily scan

[ukdj]

LDN said:

I now have to investigate this ZXZhbC thing and look how to clean...

I have fixed stuff like this in the past, PM me if you need help