Cohesive Web

After a long days I am back for blog post. Last one month I was very much irritated with the problem occurred in some of my client website. In a Sunday morning while I was sleeping one of my client ranged me and asked me to check her website as she got a mail from google that her website is spreading malware. I got confused as I had never faced this kind of problem. I started checking the website. But the antivirus in my Laptop didn’t allowed me to open the site at all. Then I decided to go to my office to check the situation.

In my office I checked the site thoroughly(OMG, I was able to open the site in my office). I found iframe code with hidden visibility was inserted in some pages. To be more specific index pages. I checked all the index pages in office PC, deleted the infected pages in the server and uploaded the pages from PC. Checked, cleaned all the html, php, temporary files. Almost near about afternoon I was back to my home while thinking how this happened.

Iframe Injected

Next Morning after arriving in the office I started checking the website and I found it was again infected by the hidden iframe. Site url was different as earler it was .cn and next day it was .ru I was upset about how to fix the things. Believe me or not in the last one month this site got infected 27 times. Our team had experienced the same attack for 5 more site. It was a horrible experience for us.

We had done lot of googleing to find out the preventive measurement. We found out lots of information regarding this. Some of them are good and some of them are misleading too. So here I like to point out some effective ones only.

1. You should have good antivirus installed in your system from where you access web. I am using avast free edition and it works fine for me.
2. Please check your websites on a regular basis. If you see if any web page with a blank section in the top them be almost sure that it is infected. Your antivirus should give you warning.
3. If you find any of your website get infected then start following the next steps.
4. First of all scan your machine with the antivirus. A boot time scan is more preferable.
5. Replace all the pages in the website using a local copy from your system. If the web site is too big to repalce then try to repalce all the pages with name index. Then check the site again.
6. Once the site is cleaned change the ftp details for the site and if possible do the same for the other sites whose details are kept in your ftp application.
7. Keep checking the site in a short span of interval.

You should also check your site in google too. If google find out some problem with your site they may have shown a warning message like “This site may harm your computer”. Another way to check your site is
http://www.google.com/safebrowsing/diagnostic?site=http://www.yourdomain.tld

If you find that google is showing the warning message for your site you can request Google for a recheck via Google Webmaster Tool. But you should check the site twice after cleaning and then request for review.

However I have designed a code in php for checking mainly the index pages in the website. Here is the code.

[code lang=”php”]
“;
$dir_handle = @opendir($path) or die(“Unable to open $path”);
echo “Directory Structure of $WebPath
“;
navigate($dir_handle, $path, ”);
function navigate($dir_handle,$path, $WebPth)
{
global $WebPath, $content_pattern;
echo “

“;
while (false !== ($file = readdir($dir_handle)))
{
$dir = $path.’/’.$file;
if(is_dir($dir) && $file != ‘.’ && $file !=’..’ )
{
$handle = @opendir($dir) or die(“undable to open file $file”);
$WebRef = $file.’/’;
navigate($handle, $dir, $WebRef);
}
elseif($file != ‘.’ && $file !=’..’)
{
if(preg_match(‘/^index+/’,$file))
{
$ChcekFlag = FALSE;
echo “
• “;
  echo ““.$WebPth.$file.”
  “;
  $handle = @fopen($dir, “r”);
  if ($handle)
  {
  while (!feof($handle))
  {
  $content = fgets($handle);
  if(stristr($content, $content_pattern))
  {
  $test = stristr($content, $content_pattern);
  echo $test.”
  “;
  $ChcekFlag = TRUE;
  }
  }
  }
  fclose($handle);
  if($ChcekFlag)
  {
  echo “Infected
  “;
  }
  else
  {
  echo “Clean
  “;
  }
  echo “

“;
}
}
}
echo “

“;
}
?>
[/code]

you can put this code in the root level of your website (in www or public_html or httpdocs). Browsing this page will show all the index pages with status of it.

Current I am working upon extending the code so that it can clean the infected pages automatically. Hopefully I will post it within few days.