Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.



  • Please log in to reply
No replies to this topic

#1 ZombyLt


  • Members
  • 1 posts
  • Local time:02:24 AM

Posted 22 December 2008 - 05:49 AM


first of all came a ban for my ip from spamhouse.com and some other spam baning sites, that i couldnt send any more emails (trojant sending spam from my pc?), so i installed kaspersky antivirus.

Then in found this virus on my website : Trojan-Downloader.JS.Iframe.oj (site is www.turtofondas.lt, for protecting others i changed index.php file, now the INFECTED file could be found at www.turtofondas.lt/index.php1).
Searched web for this virus - almost no useful information.

So i think now it is same virus on my PC and my website.

I just ran combofix program, but don`t know am i infected anymore. (After runing combofix used HighJackThis, log IMHO looked normal).

so, please, anyone help me to be sure with this :

1. How to clean my computer ?
2. How to clean my website ? Admin of hosting company offered to delete everything, wich doesnt sound good 4 me .... I found some <script> on web files, wich were not there originaly, i deleted them, but they again got there. How to clean the mess ? Is it only index.php or more files ?
Is it possible, that virus send my login / psswd of FTP server, that i can rebuild it`s bad path to the files?

I have todays combofix file & HJT.

Thanks for help!

BC AdBot (Login to Remove)


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users