Posted 22 December 2008 - 05:49 AM
first of all came a ban for my ip from spamhouse.com and some other spam baning sites, that i couldnt send any more emails (trojant sending spam from my pc?), so i installed kaspersky antivirus.
Then in found this virus on my website : Trojan-Downloader.JS.Iframe.oj (site is www.turtofondas.lt, for protecting others i changed index.php file, now the INFECTED file could be found at www.turtofondas.lt/index.php1).
Searched web for this virus - almost no useful information.
So i think now it is same virus on my PC and my website.
I just ran combofix program, but don`t know am i infected anymore. (After runing combofix used HighJackThis, log IMHO looked normal).
so, please, anyone help me to be sure with this :
1. How to clean my computer ?
2. How to clean my website ? Admin of hosting company offered to delete everything, wich doesnt sound good 4 me .... I found some <script> on web files, wich were not there originaly, i deleted them, but they again got there. How to clean the mess ? Is it only index.php or more files ?
Is it possible, that virus send my login / psswd of FTP server, that i can rebuild it`s bad path to the files?
I have todays combofix file & HJT.
Thanks for help!