Host is reporting malware

[Chris Lloyd]

I have had my host report that I may have potential malware in various pages. The ref is

SMW-INJ-27295-js.spam-5

it is appearing in admin_newplace.php, admin_editplace.php several OSM mod pages and other admin edit pages.

Looking for suggestions....

[Rob Severijns]

SMW - stands for Server Malware, it means that malicious code executes on the server side. CMW - malicious executes on the client’s side, e.g in the browser.

INJ - malicious code was injected in the file

Isn't you ISP able to cleanup the malware?

[ADC]

It has been some years since I had some malware appear on my site, so I'm afraid I don't have much current advice. However, since you have been given a list of the files affected, I would suggest (1) uninstalling any Mods, (2) delete those affected files from the server, (3) upload clean copies from your TNG download and (4) reinstall any Mods.

In my experience, ISPs do not help much in removing malware, but they may lock your site (without you asking) so it is inaccessible to visitors. I think they would be unlikely to amend files for you, but they might restore a full backup from a previous date if you request it.

I did get a bit paranoid when it happened to me, in case there were files that I had not found, so I backed up my data, wiped the site and did a full reinstall, and reloaded the data. It can take quite a while to get back up and running again so I would not suggest this as a first step, but at least you have it as the nuclear option.

It's probably good to remember that this malware may be trying to infect visitors to your site, so you may want to consider putting your site in maintenance mode to help stop it spreading.

 

[Chris Lloyd]

Thanks for the suggestions. Have set site in maintenance while I do more research on the individual files. Some of them are part of TNG i.e. not mods.