Every couple of days my computer suddenly has the .htaccess written to very folder on it. I have to do a del /s .htaccess from my C: drive to get rid of them. I've got AVG and MalwareBytes on but they can't find the virus and the virus won't let AVG update. Any ideas?
1
-
I apologize to the people that answered my question as I provided very little info on my computer. I should know better. It's a older computer (pent 4) with windows 2000 that's used as a web sever (Apache).– slimSep 20, 2010 at 17:13
Add a comment
|
4 Answers
First, change your passwords. A very similar question has been discussed on StackOverflow. Below is the quote of what I believed was one of the best answers from that question.
Typically when it's the .htaccess files that have been infected, it's usually the result of stolen (compromised) FTP credentials.
This usually happens by a virus on a PC that has FTP access to the infected website. The virus works in a variety of ways, but usually one of two.
First, the virus knows where the free FTP programs stores it's saved login credentials. For instance with FileZilla on a Windows XP PC, look in
%APPDATA%\FileZilla\sitemanager.xmlIn there you'll find, in plain text, all the websites, usernames and passwords that user has used FileZilla to access via FTP.
The virus finds these files, reads the information and sends it to a server which then uses them to login to the website(s) with valid credentials, downloads specific files, in this case the .htacces files, infects them and then uploads back to the website. Often times we've see where the server will also copy backdoors (shell scripts) to the website as well. This gives the hacker remote access to the website even after the FTP passwords have been changed.
Second, the virus works by sniffing the outgoing FTP traffic. Since FTP transmits all data, including username and password, in plain text, it's easy for the virus to see and steal the login information that way as well.
- Change all FTP passwords immediately
- Remove the the infection from the .htaccess files
- Perform a full virus scan on all PCs used to FTP files to the infected website
- If the website has been listed as suspicious by Google, request a review from Google's webmaster tools.
If the hosting provider supports it, switch to SFTP which encrypts the traffic making it more difficult to sniff.
Also, look at all files for anything that doesn't belong there. It's difficult to find backdoors, because there's so many different ones. You can't go by the datetime stamp either because these backdoors modify the datetime stamp of files. We've seen infected files with the exact same datetime as other files in the same folder. Sometimes the hackers will set the datetime stamp to some random earlier date.
You can search files for the following strings:
- base64_decode
- exec
- fopen
- fsock
- passthru (for .php files)
- socket
These are somewhat common strings in backdoors.backdoors.
You might find this Unmasking the Antivirus 2009 .htaccess Exploit useful as well.
-
2
-
@Hello71: I had chosen the best answer, as per me, from that post and also gave the link of the source as well, nevertheless I hope now it satisfies your problem as I have edited it further.– user42307Sep 10, 2010 at 0:47
-
@Harpreet - I agree with @Hello71 that it's bad form to just copy an answer verbatim from elsewhere, especially since you are now getting credit for somebody else's answer. I am not voting down your question, but I did edit it to make it more clear where the info originated from, and I would suggest making your answer community wiki, since that would prevent you from gaining unfair rep points from upvotes for an answer you didn't write (you'd keep what you already got), and would make it possible for any user to help contribute to this answer.– nhinkleSep 13, 2010 at 3:42
-
@nhinkle: How is it wrong to QUOTE someone's answer from some different website? Would this answer get any vote in its original website and place, for this current question, if it was not quoted? How am I stealing his points? I am sharing it and giving full credit to the owner by explicitly giving the link to that answer and also mentioning that its not my work.– user42307Sep 14, 2010 at 0:07
-
@Harpreet: there is nothing wrong with quoting an answer from elsewhere. And yes, I would upvote the original post. You're not stealing anybody's points, and acknowledging that it was a quote and linking to the source was well done. My point was that you were getting credit for an answer which was almost entirely somebody else's. For an answer which was directly copied, community wiki seemed like a good solution since it allows other users to add to/edit the quote, and prevents any contention over votes, since CW posts don't earn/lose rep.– nhinkleSep 14, 2010 at 0:34
This is just a guess, and after reading what @Wil and @Harpreet have said, and thinking why a process would put .htaccess in every folder, it sounds to be like your computer is either infected by a virus or has in some way become part of a botnet. You'll want to find out if any process is listening for incoming connections on port 80 (the standard web port). The easiest way to find this out is, at a command prompt: netstat -a|find ":80". If you get any result, you'll next want to try to find out what is listening. Again, at a command prompt: netstat -ab|more. You'll be looking for the line you found above. The next line will tell you what's listening.
In thinking about the "why" question, the presence of .htaccess in every folder might be a technique to expose everything on your computer to the Internet via a "web server." It might be a tactic intended to steal your data or identity. As @Wil notes, .htaccess is an Apache configuration file. Knowing the contents of the .htaccess file might provide a clue. Have you noticed any other files showing up? For example, the Gumblar botnet also writes images.php into any folders named images. .htaccess attacks usually target web servers and result in traffic being silently redirected to malicious web sites.
I have never heard of a .htaccess virus, unless this is new.
Do you have Apache or any third party Apache tools installed? It is possible that at one point, a misconfiguration set your root drive as the docs folder and as a result, a .htaccess file is being written in every folder.
answered Sep 10, 2010 at 0:15
To remove the virus, I suggest doing from a boot AV CD
http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/
.
