Elxis CMS Forum

Support => General => Topic started by: ROUBOS on May 09, 2014, 11:57:08

Title: Website not working.. getting threat from antivirus [SOLVED]
Post by: ROUBOS on May 09, 2014, 11:57:08: Hi,
this website www.chalkitis.gr was working fine, but now when I try to visit it I get a threat from my antivirus and the site does not work.
If you visit it, you'll see a flash intro I made, click on any option will trigger the threat.

Now the admin area works fine and I am able to login. I just loged in and enabled the Elxis Defender.

I have attached a screenshot of the threat that appears from Avast.

Any help would be appreciated.

thanks
Title: Re: Website not working.. getting threat from antivirus
Post by: xmanhattan on May 09, 2014, 12:15:09: Elxis Defender is not going to help you. I have seen this happen with some clients. They had a virus on their system and the virus attached itself to the .js files of the site.
Make sure that your system is completely clear. Do a full system scan and then download malwarebytes free to check for trojans.
Then upload the .js files again.
Title: Re: Website not working.. getting threat from antivirus
Post by: ROUBOS on May 09, 2014, 12:19:00: these files where uploaded a long time ago. I have not worked on this for over a year and from a different machine.
So should I download the files, scan them, and re-upload them?
Should I mention this to the hosting provider?
Title: Re: Website not working.. getting threat from antivirus
Post by: xmanhattan on May 09, 2014, 12:25:39: Whoever is updating the website probably has the virus or trojan on their system.
You may be able to ask the hosting site to run an antivirus but if the user of the website has one then it will return again. So far they are lucky that google has not blocked the site.
Title: Re: Website not working.. getting threat from antivirus
Post by: ROUBOS on May 09, 2014, 13:02:50: I restored from a backup from the hosting provider, and the site now works, apart from one autonomous page.
In admin it all looks good, tried saving, unpublishing it etc no luck. Still not working.

noticed that when I changed the SEO title, it works, and when I change it back it does not.
Title: Re: Website not working.. getting threat from antivirus
Post by: xmanhattan on May 09, 2014, 13:36:37: Unfortunate I came across the same problem. The reason is that it depends on when the .js files were infected.
This means that all the backups maybe infected.
The only way to solve the problem is to use a clean system and upload the .js files.
Title: Re: Website not working.. getting threat from antivirus
Post by: ROUBOS on May 09, 2014, 19:53:47: So could it be that this backup was at the initial face of infection since there is only one page with a problem?
If I go a little further back in time and all pages work, would that mean that we're clean?
Title: Re: Website not working.. getting threat from antivirus [SOLVED]
Post by: ROUBOS on May 10, 2014, 11:34:39: Checked again today and the page works fine now...
So I guess it's ok. I will leave it as is, and if it happens again I will restore from a previous date and scan for viruses.

thanks for your help
Title: Re: Website not working.. getting threat from antivirus [SOLVED]
Post by: datahell on May 12, 2014, 20:08:37: I guess the malicious code was in database (javascript injected into editor area), this is why you couldn't find any bad javascript file. Usually this happens due to virus in your computer or a malicious browser addon. You can get a mysql dymp and then search SQL file using keyword "script", or ".js", or things like that, to make sure your articles are clean.