.htacess virus - does anyone know how to get rid of this thing?

Question

Every couple of days my computer suddenly has the .htaccess written to very folder on it. I have to do a del /s .htaccess from my C: drive to get rid of them. I've got AVG and MalwareBytes on but they can't find the virus and the virus won't let AVG update. Any ideas?

Answer 1

First, change your passwords. A very similar question has been discussed on StackOverflow. Below is the quote of what I believed was one of the best answers from that question.

Typically when it's the .htaccess files that have been infected, it's usually the result of stolen (compromised) FTP credentials.

This usually happens by a virus on a PC that has FTP access to the infected website. The virus works in a variety of ways, but usually one of two.

First, the virus knows where the free FTP programs stores it's saved login credentials. For instance with FileZilla on a Windows XP PC, look in %APPDATA%\FileZilla\sitemanager.xml

In there you'll find, in plain text, all the websites, usernames and passwords that user has used FileZilla to access via FTP.

The virus finds these files, reads the information and sends it to a server which then uses them to login to the website(s) with valid credentials, downloads specific files, in this case the .htacces files, infects them and then uploads back to the website. Often times we've see where the server will also copy backdoors (shell scripts) to the website as well. This gives the hacker remote access to the website even after the FTP passwords have been changed.

Second, the virus works by sniffing the outgoing FTP traffic. Since FTP transmits all data, including username and password, in plain text, it's easy for the virus to see and steal the login information that way as well.

1. Change all FTP passwords immediately
2. Remove the the infection from the .htaccess files
3. Perform a full virus scan on all PCs used to FTP files to the infected website
4. If the website has been listed as suspicious by Google, request a review from Google's webmaster tools.

If the hosting provider supports it, switch to SFTP which encrypts the traffic making it more difficult to sniff.

Also, look at all files for anything that doesn't belong there. It's difficult to find backdoors, because there's so many different ones. You can't go by the datetime stamp either because these backdoors modify the datetime stamp of files. We've seen infected files with the exact same datetime as other files in the same folder. Sometimes the hackers will set the datetime stamp to some random earlier date.

You can search files for the following strings:

• base64_decode
• exec
• fopen
• fsock
• passthru (for .php files)
• socket

These are somewhat common strings in backdoors.backdoors.

You might find this Unmasking the Antivirus 2009 .htaccess Exploit useful as well.

Answer 2

This is just a guess, and after reading what @Wil and @Harpreet have said, and thinking why a process would put .htaccess in every folder, it sounds to be like your computer is either infected by a virus or has in some way become part of a botnet. You'll want to find out if any process is listening for incoming connections on port 80 (the standard web port). The easiest way to find this out is, at a command prompt: netstat -a|find ":80". If you get any result, you'll next want to try to find out what is listening. Again, at a command prompt: netstat -ab|more. You'll be looking for the line you found above. The next line will tell you what's listening.

In thinking about the "why" question, the presence of .htaccess in every folder might be a technique to expose everything on your computer to the Internet via a "web server." It might be a tactic intended to steal your data or identity. As @Wil notes, .htaccess is an Apache configuration file. Knowing the contents of the .htaccess file might provide a clue. Have you noticed any other files showing up? For example, the Gumblar botnet also writes images.php into any folders named images. .htaccess attacks usually target web servers and result in traffic being silently redirected to malicious web sites.

Answer 3

I have never heard of a .htaccess virus, unless this is new.

Do you have Apache or any third party Apache tools installed? It is possible that at one point, a misconfiguration set your root drive as the docs folder and as a result, a .htaccess file is being written in every folder.

Answer 4

To remove the virus, I suggest doing from a boot AV CD

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

.