16-05-2010 18:06 - edited 16-05-2010 18:08
I set up my Virgin webspace today and uploaded a site I'd created in RapidWeaver. I work on an AppleMac and as far as ClamXav is concerned I'm virus/trojan free.
When my friend opened the site on his PC Norton came up with 3 low level threats:
Threats found: 3
Here is a complete list:
Threat Name: W32.Spyrat
Threat Name: W32.Spyrat
Threat Name: W32.Spyrat
They all point to VirginMedia. So my question is - Is the server there compromised?
How do I resolve this 'threat' as I eventually need to put the site up in it's proper URL - not the temporary one I've set up and I'd prefer not to be forwarding trojans...
Help would be appreciated
on 17-05-2010 18:20
I have tested the site from here, and it does appear that the files in question are infected with trojans. I would suggest that the program used to create the slideshow and video is to blame for this - I notice that both the video and the slideshow are encoded as executable files, which is out of the ordinary.
I would strongly recommend running a full antivirus scan on your machine, and using a different webpage authoring program - there's really no need for photos or videos to be re-coded as .exe files.
Hope this helps.
Help & Support Forum Team
on 18-05-2010 23:56
The files listed are the ones the W32.spyrat creates. I've fully scanned my Mac and the folder with the files in that were uploaded - they've all come up clean.
The software used to create the site is RapidWeaver which also appears clean. Macs can't run .exe files and none-of the files in the folder uploaded contain either slideshow or video files.
So Who/what is paigesheppard? (from the links supplied by Norton on original post).
And if I can't detect them at my end how do I clean this up? I've opened the site on three PCs - all running McAffee and they detect no trojan?
on 19-05-2010 12:24
I have also just set up a small, simple web site on virgin webspace. I used Kompozer. No videos, no exe files. My computer is virus free, I've checked it umpteen times with Norton. Norton also identifies three instances of W32.Spyrat, and also says that they are in paigesheppard's web space. I contacted Virgin through their help pages, and even put the link in to the Norton report, and received a badly spelled reply saying that they can't help me if my computer has a virus.
I had asked three questions.
Why is there a virus on their webspace server (what security are they using, and why didn't it work)?
How are they going to get rid of it?
Why doesn't their freebie software tell me I'm accessing a virus-ridden website?
I'm interested in the answers, if I eventually get any, but I'm going to take my little website elsewhere.
on 19-05-2010 12:59
Interesting loonyfem. I've not heard back from them yet - I'll start posting on the web - see if this is a common problem and if Virgin Media are up to the job...
on 19-05-2010 13:23
Found this (bottom of thread)
Other Virgin customers or sites are also in various searches with this virus -
VIRGIN - HAVE YOU GOT A PROBLEM?
I've just shelled out £40 for Norton and scanned my entire computer and all the files associated with my webspace. Guess what - no virus present. (which is what I'd expect - I am using a Mac after all...)
Will you refund me the money I've just wasted when you finally admit you have a problem at your end?
on 19-05-2010 13:34
Hmm. My pc dual boots into Linux or Windows. I actually created the website in Linux, so was horrified and bemused when somebody I'd asked to place a link told me about the virus. What's interesting is that Virgin don't seem to be listening/reading their emails properly. Their assumption is that the writer has the virus, when in fact it's paigesheppard's web space which has the virus, and it looks like it's leaking all over the shop.
So I have spent £57 on Norton, which covers 3 pcs for the year, to find no viruses at all. Hmph. This is an issue for Virgin, because whoever they contract out their personal webspace service to doesn't seem to be doing that good a job, and nor is their helpdesk.
on 19-05-2010 13:43
The files are on the customers website and therefore are his responisbilty, it a folder they will need to be removed by the creator of the site. Even AVG shows them as a virus.
on 19-05-2010 14:00
the creator of the site with the viruses is paigesheppard. Somebody, probably Virgin, needs to tell paigesheppard about the problem, or remove the site.
on 19-05-2010 14:02
The files in the thread above are the ones Norton say are there on the site.
My actual site is here:
I've scanned the files in my webspace - with Norton - and they say there is no virus. My computer is clean. I've also scanned with ClamX...
Do you not think it's weird that other people using virgin medias webspace to host their sites ALSO have this virus?
Any mention of this virus I've found on the web ALL point back to virgin webspace.
I only created the site and tested here with one person - no other exposure to the web...
How can I fix what is not visible at my end?
Now whoever this paigesheppard is might have a virus on his site - but how has it got undetected onto mine and why hasn't Virgin Medias own security picked this up at source?