Cant believe it....my company website has been hacked again and now directs you to some poxy trading website!!!!...It took fecking weeks to get it sorted last time :( Not happy chappy at all this morning!!!

 

kit

No backups?  What is the site based on - a CMS system?

 

Fully patched?  simple/easy to guess passwords?

Doesn't sound good... Do you manage the website yourself or does someone else do it for you?

Who manages the site?

Our IT/web guy is sorting it and moving it to another server. Its just a pain having it down just when you've written to someone explaining who you are and saying look at our website!!!....And just to add to my IT problems I cant seem to download malwarebytes!!...It keeps coming up with a message saying the download has a virus it in!!!.....Oh the joys!!!

 

K:)

Sounds like your machine may well already be infected with something.

Malwarebytes: http://www.malwarebytes.org/mwb-download/
Sophos: http://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx

 

Both of these you should be able to download run.

Yup if one of your machines is infected, and you access the site/hosting admin panel with it this will be the cause - assuming that the passwords are incredibly hard to guess

Didn't one of your machines previously have a virus?

Yeh my machine was virused before and MSE wouldn't download after that so went with AVG free and malware bytes but malware bytes started saying that the free trial had run out so uninstalled it and tried to re install it but it kept saying that after it was download that the file was virused!!! Such a pain in the hoopy!!! :(

Malwarebytes full version free trial I presume? If so the free version is still usable unless you have a dodgy copy.

AVG is awful and I bet the machine is riddled with viruses.

Point the machine at trend micros "house call" pages and run an online scan

There's obviously something wrong...this is the screen grab when I down load trend micro.....its the virus message at the bottom I'm talking about.....I don't know what's causing that!!!

 

 

trendmicro.pdf

just figured out it must be something to do with IE. I updated it the other day and when I try and download through I'm getting the "download contains a virus" messages....I've just download trend micro through Google chrome and its now downloaded fine and scanning away....so what could be the problem with IE? I know some don't like IE but I find the interface very user friendly compared to others.

 

Cheers

 

Kit

I can't remember what virus it was but I have sorted a machine that previously had the same issue... It would block any attempt to download anti virus of any kind, I ended up downloading the setup files on another machine and transferring them to the infected machine using a usb key...

Have now downloaded Malwarebytes using Google Chrome and its has now scanned just after trend micro and both have found nothing....so it must be something to do with IE stopping downloads, thinking of it IE wouldn't download a word document from an email the other day so had to open it and download it with Google Chrome!!!

No point in just moving it to another box you'll get nailed again unless you fix the vulnerability.

 

Are you scanning the box or having it scanned.

 

Might be worth either buying a service or getting to grips with a  copy of Nessus.

 

Are your patches up to date?

 

Anything sitting out on the internet really needs to be properly hardened. If you've not got the skills or resources in-house to do it you should really consider a hosted service.

No point in just moving it to another box you'll get nailed again unless you fix the vulnerability.

 

Are you scanning the box or having it scanned.

 

Might be worth either buying a service or getting to grips with a  copy of Nessus.

 

Are your patches up to date?

 

Anything sitting out on the internet really needs to be properly hardened. If you've not got the skills or resources in-house to do it you should really consider a hosted service.

Aspman ...you lost me at box!!! Are we talking about the website or the downloading issue? If its the website then its being stripped down and rebuilt then moved to another hosting crowd as my IT guy says that the crowd hosting it now "web hero" have had loads of similar issues.

 

kit

The Web Hero reviews are not that great either.

Kit

You could try resetting IE back to its default settings. Tools > Internet options, then advanced tab. Press the big reset button at the bottom.

Mannyo...that's who the site was hosted with, its now going to be hosted somewhere a bit safer. Will try resetting the IE settings and see what happens...i've just watched a video on you tube showing how to solve the problem http://www.youtube.com/watch?v=jnO7kS6Cfo0 but ill have to get another machine set up next to me so I can watch the vid on one machine and do the changes on the problem machine...as you can see I'm not very techy at all!!!

 

K:)

Aspman ...you lost me at box!!! Are we talking about the website or the downloading issue? If its the website then its being stripped down and rebuilt then moved to another hosting crowd as my IT guy says that the crowd hosting it now "web hero" have had loads of similar issues.

 

kit

 

website.

 

It depends what sort of website you have and what it's hosted on. All websites are on web servers (the host owns and runs the servers). The servers are usually version of Microsoft IIS  or Apache but there are lots of others. the websites themselves can also have lots of different component parts with their own technologies.

 

All the hackers out there (crackers to be pedantic) are constantly looking for gaps in the protection in these servers. Usually they look for servers that aren't running up to date software and are missing security patches.

They can then exploit the gaps to take over sites and do what they want to do.

 

If your site is hosted then the host will deal with the server and it's probably up to them to keep that up to date. The website is probably your problem and your guys will be expected to keep it up to date.

 

If you move host and the problem was really with your website then you'll get hacked again shortly because the problem will still exist. If the issue was with the host and your new host is better then you're probably in a better place.

 

Either way you should be monitoring the site for unauthorised changes either manually or using a service and have an effective procedure (that you've tested) to being the site down quick and restore it. It's probably more important to pull it and get a holding 'maintenance' page up quick. If you serve malware to a customer through a compromised site they'll probably never forgive you plus you may end up on filtering blacklists which are not east to get off of.

 

All depends how important the site is to your business.

Hi Aspman

 

Thanks for the replies...all of your points above are being addressed by IT guys so hopefully it should be resolved and made secure by Monday Well hopefully!!! I've told them I want the site monitored so if anyone does hack it or try they will be alerted instantly.....silly me just thought that who ever hosted your site would monitor it!!!