It appears as if my XOOPS site has been hacked, a iframe pointing to http://googlerank.info/counter has appeared in the coding on the main page which then trys to download something nasty.

I'm not sure where to look to remove it though, i extracted the MySQL database and couldnt find it in any of the tables and did a search for it in all the php,htm,html,css files of the site too.

Although not visable to a site user its coding appears underneath the menu on the left of the site, just before the random xoopsgallery image.



Anyone have any ideas where i should look to remove this?

The site is http://www.blmra.co.uk, my virus scanner catches it every time. Although look at your own risk, it trys to install a trojan.

Thanks

Deano

Hi,

check template cache folder (templates_c). Delete files there.

That did it! Is there anyway i can stop this from happening again?

I have installed XOOPS protector since this occured,

Thanks Stefan,

Dean

Quote:

BTW, just a wee warning, if you knew there was a Trojan on your website you should have closed it to the public.

How many peoples computers has it infected that visited your site? they can sue you if they find out you knew about it.

Hi deano42,

one thing I forgot: you should not delete index.html file. It is available in other folders, so please delete the files in "templates_c" folder again and copy index.html from one of other folders to "templates_c" folder!

It is a simple text file called index.html with this text:



Sorry about that mistake!

Probably the problem is with your hosting company and not with xoops, so there is not much you can do. Maybe creating .htaccess in templates_c folder may help, but I'm not very familiar with Apache ...