« previous next »
Pages: [1]   Go Down

Author Topic: Ho to remove JS:Redirector-H7 [Trj]  (Read 6884 times)

0 Members and 1 Guest are viewing this topic.

davindersingh

  • Guest
Ho to remove JS:Redirector-H7 [Trj]
« on: May 21, 2009, 01:33:17 AM »
I got JS:Redirector-H7 [trj] virus on my website. I figured it out that its a messed up script on my index files and javascript files

My site is in Joomla, and this virus is spread all over site. How can i remove this. Is there any automated software for that? Or is their any programme through which i can know which all files are infected?

Thanks in advance
Logged

Offline !Donovan

  • Web Analyst
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2219
    • The WAR Against Malware
Re: Ho to remove JS:Redirector-H7 [Trj]
« Reply #1 on: May 21, 2009, 01:56:37 AM »
Whats your FULL website name?

Example: hXXp://www.your-website-name-here.com
Logged
Familiarize Yourself! | Educate Yourself! | Beautify Yourself! | Scan Yourself!
"People who say it cannot be done should not interrupt those who are doing it."

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89065
  • No support PMs thanks
Re: Ho to remove JS:Redirector-H7 [Trj]
« Reply #2 on: May 21, 2009, 02:07:37 AM »
Well first you don't mention the site, change the http in the url to hxxp, to avoid accidental exposure.

Ensure that you are using the latest version of Joomla as old version are vulnerable and being exploited.

You will also have to change and passwords, ftp, control panel, etc. Any template files should also be checked as this is a common means of spreading it to new pages, etc. You will have to look for script tags containing obfuscated javascript and remove those tags or upload clean versions after you have taken care of any software updates, etc. You should also speak to your Host.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

davindersingh

  • Guest
Re: Ho to remove JS:Redirector-H7 [Trj]
« Reply #3 on: May 21, 2009, 04:20:38 AM »
its
hxxp://www.uwcm.org/shareyourself/
Logged

davindersingh

  • Guest
Re: Ho to remove JS:Redirector-H7 [Trj]
« Reply #4 on: May 21, 2009, 08:18:21 AM »
I just checked it.. its on all websites on server

Is there any way to remove that?
« Last Edit: May 21, 2009, 06:09:02 PM by davindersingh »
Logged

zeroality

  • Guest
Re: Ho to remove JS:Redirector-H7 [Trj]
« Reply #5 on: May 21, 2009, 08:52:13 AM »
I had this on my site too. What I did was download the latest copy of my CMS (using CMSMS) and uploaded all the files, overwriting the old ones. I had to do that for my vBulletin forum as well.

That got rid of the virus.
Logged

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89065
  • No support PMs thanks
Re: Ho to remove JS:Redirector-H7 [Trj]
« Reply #6 on: May 21, 2009, 05:13:53 PM »
Quote from: davindersingh on May 21, 2009, 08:18:21 AM
I just check it.. its on all of my websites on server

Is there any way to remove that?

I don't believe there is an easy to resolve this as the script tags, although the same sort of format, I believe are different so you can't easily use something like a find and replace. You can't use wildcards to remove the opening and closing script tags and the contents as you have legit scripts on the pages.

That is why I said you would effectively have to use your off-line clean back-up files to replace the infected ones.

If you haven't got back-ups, a good time to do some future planning:
Presumably the injected scripts are in the same location after the closing Head tag and before the opening Body tag (see image).

So you might be able to do a find and replace find <Head/>*<Body> (where the * is a wildcard, depends on the software used.) replace with <Head/><BR><BR><Body>. So you are putting the original tags back in place with a couple of line breaks between them.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security
Pages: [1]   Go Up
« previous next »