Web Server infected?
From: Thomas Goodson (thomas_nospam.goodson_at_omega-link.com)
Date: 09/16/05
- Next message: rod.funk_at_sierraclub.org: "Re: Strange trojan (?) Backdoor.Graybird"
- Previous message: ejcornwell_at_coopertire.com: "Re: Strange trojan (?) Backdoor.Graybird"
- Next in thread: David H. Lipman: "Re: Web Server infected?"
- Reply: David H. Lipman: "Re: Web Server infected?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 16 Sep 2005 14:58:24 -0400
I have a customer's web site that seems to be infected. When the local
internet cache is empty and it is the first time that I hit the site from a
given IP address, I'll get back the normal web page with the following text
added to the top of the message:
<script language=JavaScript src=/oofohmg.js></script>
and internet explorer will seem to be in a loop. In any case, the load of
the page never reaches the point where it displays "done" on the status bar.
If I do a refresh of the site, then it will load correctly and the text
above will not appear in the view source. It has been suggested by the web
host that I have a virus. I have tried this from 5 different computers
running 3 different anti virus program, 1 of which was freshly loaded from
the windows xp sp2 cd. Anyone else encountered this? Any ideas?
** Tom **
- Next message: rod.funk_at_sierraclub.org: "Re: Strange trojan (?) Backdoor.Graybird"
- Previous message: ejcornwell_at_coopertire.com: "Re: Strange trojan (?) Backdoor.Graybird"
- Next in thread: David H. Lipman: "Re: Web Server infected?"
- Reply: David H. Lipman: "Re: Web Server infected?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]