website hacked into again !!

Karen Ringrose · #1 06-26-2009, 08:16 PM

Hi

Does any body have any ideas ? I have been hacked into again BV have just cleared all problems requested a review and now were back to square one again. I am running through FTP files right now and just deleting all the files that have this code inside just to be rid once and for all I HOPE
Do I need to do anything else, I keep changing my FTP passwords and I am not publishing this site but after checking these files in FTP and the pages that I can actually view the source have these codes numbers and % signs.

How do I actually get into these pages to delete these codes? Sorry submitting tickets seems to take forever, is there anyway that I can do this myself as I have to wait for a day to get a reply to any emails from support I do not mean to seem impatient, but I do not feel as though I am getting any support and this is my living and if this gets into my other site, well that would be for us we would have no income.

Sooo would appreciate any help and please bear in mind that I am a real beginner here and allot of stuff is totally foreign to me but I am trying to learn as I go. I do not open any emails that I don't know who is from and I do not download without scanning first, so I try to do all I can to keep things as tight as possible! I have avast AV and spybot and I scan twice a day and also run malwarebytes daily to check - what am I doing wrong??

Muchly thanks for any help
--

Karen Mac · #2 06-26-2009, 08:23 PM

you need to RESET ALL PASSWORDS.. and one more time..

YOUR SITE IS BEING HACKED BECAUSE YOU ARE UPLOADING THE VIRUS, the virus COPIES THE PASSWORD.

IT ATTATCHES ITSELF TO WHATEVER FILES ON YOUR COMPUTER and.. TO YOUR BROWSER... Whenever you login somewhere it STEALS THE PASSWORDS.

You first need to insure that your computer is clean. Take it to a professional.

Then.. get your account totally reset. You will need to rebuid/republish.

Karen

Karen Ringrose · #3 06-26-2009, 08:36 PM

Hi Karen

How do I scan and save the files that are safe and not infected? I have tried to scan on the right click as i do when I download but this is not an option in the FTP files ? I need to obviously save the as much stuff here as possible to a dvd to save on rebuilding, as I do not have the money to pay someone and I the time to rebuild both sites and so far the favour site is safe and after working through the night on this site over the last 3 years I could not bear to loose all of this work as its still not finished yet !

Thanks in advance

Karen Ringrose · #4 06-26-2009, 09:07 PM

Hi Karen

Just to check what you exactly mean by this ?

YOUR SITE IS BEING HACKED BECAUSE YOU ARE UPLOADING THE VIRUS, the virus COPIES THE PASSWORD.

Do you mean that by publishing pages of this website ? As this has not been published for months if thats the case ! I have only published my other website this year. So how would I upload it? sorry totally lost here?

The computer is virus free and has been checked by a paid IT support team and is constantly scanned with no results found and I have Avast and spybot running. The only problem is the one website, other forums and paid IT support have suggested that it was not cleaned properly maybe and reset ??

Thanks

Karen Mac · #5 06-26-2009, 09:12 PM

Ok.. before.. in your other half dozen threads about this.. you said.. you had the account reset. If you did .. then you had to upload or republish the site? YES OR NO?

If NO.. doesnt matter

If you have had the site CLEANED or FIXED and it was working with NO VIRUS.. then when YOU LOGIN your passwords are being stolen.. THATS THE ONLY WAY IT CAN KEEP HAPPENING. You have a keystroker virus that records your logins.

The only other POSSIBILITY is that the virus is not being removed from the server. The ony way to insure this is to have your account TOTALLY RESET. Do NOT restore the backups. DO NOT DOWNLOAD ANY FILES. Once this is done and the passwords reset, you wil have to REPUBLISH.

But .. You said you had the last done.. so.. YOU TELL ME.

Karen

Karen Mac · #6 06-26-2009, 09:31 PM

And YES it could be the second site that has the virus as well .. but they hijack the one with MOST traffic.. its on the same server no? Same passwords no?

Karen

Karen Ringrose · #7 06-26-2009, 09:36 PM

Once I had the word from BV maintenance to contact google, I requested a review as I was told to do. One day it was there agin in the searches but not in the organic search, so I went back to check the following day before I requested google to reconsider site and thats when I noticed the attack warning. It was only a matter of 24 hours before google blocked my site again !
I never republished or published this site at all, never realised that I had to! I did Changed Cp password as i thought I had to.

With regards to the account being totally cleaned and reset this is exactly what I thought was done by BV maintenance as otherwise why would she tell me to request a review from google asap ? I have been speaking with a girl there for the past 2 weeks trying to solve this.

I did not restore any back ups or publish any pages in urban and the only thing that I have downloaded since told was ok from BV as I thought site was clean was to download tools to try to get rid of these codes today but not before scanning them with micro trend malware removal tool and malwarebytes, so I am not trying to take any chances.

So basically by me going through the ftp files and deleting files is a waste of time? Some of the files in there are ancient and infected but have not been used for past year or 2 since these pages were updated.

Thanks again

Karen Ringrose · #8 06-26-2009, 09:40 PM

Re second site I have checked this and it all seems to be ok and I have had it checked too on with dasient and others and no codes showing in any pages
plus I have checked through the pages on FTP and online in the view source, sp surely it would show up there as all the others have !
but yep its all part of the same I guess !

never knew this could all be soo complicated:(

Karen Mac · #9 06-26-2009, 09:47 PM

If the files on the server have a NEW Date on them.. then theyve been UPDATED either by the virus or from a backup.. and the backup was virused. Thats the bottom line. IF YOU DOWNLOADED files that were virused.. then the virus is on your computer AGAIN. Thats a fact!

If you are on a NETWORK, a good hacker on your network can record ALL ACTIVITY including your logins. If you are running any WIRELESS connections on your HOME network.. you can also be HACKED there.. You need to get your isp to reset all of your WAP connections to the internet. And reset your home network.

Karen

Karen Ringrose · #10 06-26-2009, 10:08 PM

Ok this is silly now I cannot cope anymore with this, I am on a wireless hub and have also just found money missing from bank a/c and I do most banking online, all my ordering online :(
Ok so do I need to get BV to totally wipe urbancouture site of the server?
will this be enough ? So this means start from scratch again to rebuild ?
What would happen to thelittlefavourboxcompany? will that go to? Please say no :)
I feel like turning this thing off now driving it to a rubbish tip ! How can something like a machine be it very clever, get me sooo wired and why wern't there such things when I was at school to learn about them ! lol

Thanks again for all your help

Karen Mac · #11 06-26-2009, 11:27 PM

Yes it would ALL disappear, but you are reinfecting yourself everywhere.

If you have money missing from a bank also.. im going to say its ON YOUR COMPUTER somewhere. It records ALL LOGINS AND PASSWORDS even those at your bank.

You best check in to identity theft and alert the credit bureaus, banks credit cards etc and shut EVERYTHING DOWN TIGHT.

Karen

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)