help with trojan in website

[Alan C]

Hiya. My friend as a persistent trojan on her website which even after replacing all the files on the server it's still there. How the fuck do we kill it? Her service provider has been about as useful as a pack of stoned donkeys.

[mistermack]

Hiya. My friend as a persistent trojan on her website which even after replacing all the files on the server it's still there. How the fuck do we kill it? Her service provider has been about as useful as a pack of stoned donkeys.

I'm no expert, but, how do you know that when she replaced all the files, she didn't replace the trojan?

If the trojan is in her backed up copies, then it will go onto the website, when she replaces the files.
I would run the best scan that you can on the source material that she uses.

That might not be the problem, but it's one possibility, and needs to be eliminated.


ps. A pack of stoned donkeys? That sounds hilarious. Any video available?

[Alan C]

She ran an extensive scan today, all clean, so don't think it's that.

[mistermack]

She ran an extensive scan today, all clean, so don't think it's that.

Maybe it's coming from the service provider's end then. Is it a big organisation, or a cut-price bargain?

Other than that, I'm out of suggestions.

Mind you, when you say she's run an extensive scan, that doesn't eliminate the possibility. It's the QUALITY of the scanning program that counts. Some scans miss stuff that others will get.

I use IOBIT malware fighter, and IOBIT Advance Systemcare. Both are free, and both find nasty stuff on old disks that I used to use with Norton Antivirus. So obviously, when I was using Norton, stuff was getting past it.

[rachelbean]

Could you be more specific about the nature of the trojan? What exactly is happening to her site/files?

[Pappa]

It's probably worth looking into their FTP software. It's a major source of viruses that are off the radar for most anti-virus companies. FileZilla is a target for a lot of website Trojans.

[Alan C]

Could you be more specific about the nature of the trojan? What exactly is happening to her site/files?

Ah, I'll find out.

It's probably worth looking into their FTP software. It's a major source of viruses that are off the radar for most anti-virus companies. FileZilla is a target for a lot of website Trojans.

Mmok, check that too.

Cheers

[Alan C]

Ok. About the FTP query.

'I am using WSFTP 95 LE, althought today I went trough Telecom Cpanel and
deleted all the files trough there.
Really it should be empty...but its not.
Still coming up that warning.'
I think that's telecom control panel, not familiar with it myself.

And this is warning that comes up;

[mistermack]

Again, bearing in mind I'm only guessing, the wording on the warning is interesting.

It says that this page '' has been reported as an attack page ''. It doesn't say '' Trojan detected ''.
So maybe it's recorded as an attack page in the database of the antivirus program, and it won't matter what you put on it, or how clean it is now. It might be the actual address that the antivirus is responding to.

Like I said, that's just a guess.
If you want, pm me the address of the page, and I'll go to it and see if my antivirus reacts to it.

[Alan C]

She fixed it.

[JimC]

If you need to deal with trojans, may I suggest well-armed Greeks?