Trojan.Blackhole-488

Question

Shylock1966 Author

Level 2

405 points

Trojan.Blackhole-488

Can anybody help with this virus problem. I use the free Clamxav virus checker now and again just to check if everything is ok with my mac. I run a website and google Chrome is showing a warning message saying my website could have been hacked. I have submitted a message to my web host company, and in the meantime done a scan of my hard drive. Clamxav is showing the machine infected with the Trogan.Blackhole-488, it looks like its come from the firefox cache folder. I cannot find anything about this trogan so i dont know if its a hoax, machine is running fine. Can somebody please advise..

Imac 24inch 3.0ghz 4Gbram 500Gb HD iPhone 3g, Mac OS X (10.7.2), Nvidia 8800Gs

Posted on Jun 21, 2012 3:21 PM

Reply

Answer 1

Top-ranking reply

Carolyn Samit

Level 10

165,673 points

Jun 21, 2012 3:52 PM in response to Shylock1966

Mac OS X (10.7.2)

I couldn't locate any information for that malware but keeping your Mac OS X software update to date is the best way to prevent security problems.

If you are running v10.7.2, click your Apple menu icon top left corner of your screen. From the drop down menu click Software Update...

That will bring your Mac OS X up to v10.7.4.

You could try the ClamXav support forums here for help with: Trogan.Blackhole-488

Reply

Answer 2

thomas_r.

Level 7

32,001 points

Jun 21, 2012 4:02 PM in response to Shylock1966

I'm not sure what that is, but ClamXav will always include an "OSX" in the name of the malware if it affects Mac OS X. So this must be Windows malware, and can't affect your Mac. Of course, that's a completely separate issue from the hacking of your web site. You'll definitely need to check into that.

Reply

Answer 3

etresoft

Level 9

50,854 points

Jun 21, 2012 5:11 PM in response to Shylock1966

You may have any number of trojans in your Firefox cache. They aren't anything to worry about. You also may have an infected website that is something to worry about. However, they are not related. If your website was hacked it was probably just some WordPress or PHP exploit. Check all of your HTML and Javascript files for obfuscated Javascript code. Remove the code and change all your passwords.

Reply

Answer 4

Shylock1966 Author

Level 2

405 points

Jun 21, 2012 11:06 PM in response to etresoft

Yes the site has a lot of wordpress content, i have had trouble with this before. Checking the site for the code may be a right pain am i correct in saying that the website stored on my machine in the form of my Rapidweaver files are ok. Can i delete the website and upload again ? i will of course check the code this end and change all passwords. Many thanks for the help Etresoft

Reply

Answer 5

thomas_r.

Level 7

32,001 points

Jun 22, 2012 3:11 AM in response to Shylock1966

WordPress sites have been used for this sort of thing a lot lately... Youve really got to keep up with the updates.

As far as deleting the site and re-uploading, here's one set of instructions for dealing with the issue:

http://wpdude.com/wordpress-hacked

Reply

Answer 6

etresoft

Level 9

50,854 points

Jun 22, 2012 5:07 AM in response to Shylock1966

You can't mess around with WordPress. Some hosting sites, such as Dreamhost, provide auto-updated WordPress installs.

Reply

Answer 7

Shylock1966 Author

Level 2

405 points

Jun 24, 2012 1:19 AM in response to thomas_r.

Thany you Thomas for the helpfull advice, i have looked into the problem now with more detail. My host company have been in touch and asked me to goto http://www.google.com/safebrowsing/diagnostic?site=uk-cheapest.co.uk and put my domain at the end of the URL, this i done and it checked out ok with no problems (please see screenshot).. However when i go to my site using Google Chrome it comes up sometimes with the warning message its infected. I have checked the site looking at every page for Java script files that have been uplaoded, again nothing. All passwords changed and a few updates to Wordpress as you recomended, so i am totally baffled why chrome sometimes reports this problem ?

Reply

Answer 8

thomas_r.

Level 7

32,001 points

Jun 24, 2012 4:43 AM in response to Shylock1966

It's important to understand that that "diagnostic testing" site is nothing more than Google telling you what it has found on your site when its bots examined it, and note that that has not happened within the last 90 days. So that's not performing a live test, and the results are fairly outdated.

You really ought to go through all the steps on that link I sent you!

Reply

Answer 9

etresoft

Level 9

50,854 points

Jun 24, 2012 7:14 AM in response to Shylock1966

Shylock1966 wrote:

I have checked the site looking at every page for Java script files that have been uplaoded, again nothing.

That is not adequate. There will be no new files on your site. You have to check every file Javascript you didn't add. It will be obfuscated so you have to look closely. Don't restrict yourself to WordPress. That is just the entry point. Once WordPress is hacked, they have full access to your site.

Reply