Advanced XP Defender

[maresca]

Hi there

i am hoping someone might be able to help me here. About 2 weeks ago, our website was infected by a pop-up from the website, advancedxpdefender.com. It appears to be installing code on pages from our site (which is all in.asp coding) and uses a pop that states the user has 'not complete the scan'.

We have limited time and resources, and so far have managed to remove the code from the index page when its added. I am still not sure how they are accessing the site and managing to do this on a regular basis. we've moved hosts and they've still managed to attack the site. I don't know how these things work, whether its automated, or someone is 'manually' hacking the site.

I've made attempts to track down who this company is but to no avail. I'd love it if someone could give us some help on how to stop this once and for all.

Thanks

[Bobby]

hello there,
the advancedxpdefender infection might be on the computer that hosts your website. if i needed to place a bet, i'd say the host computer is infected, but there's also several other possibilities.
you say you've removed the malicious code from index page, but it might be also inserted anywhere else in the website code. you should look through the code really carefully; i know it might take a lot of time, but it's worth it.
there's also a possibility that the infection is on the computers that are used to develop the website. in this case, everytime someone opens website code from the infected computer, advancedxpdefender sneaks into websites code. either developers computer or host computer is infected, the infection might reach the machine through network connections, so ALL the computer in the network may need to be scanned for parasites.
have you changed the passwords for accessing websites code after the infection appeared? if the attackers have your passwords, they can access the code remotely and do whatever they want.
you can search for malicious files using advancedxpdefender removal tutorial, you can also scan computer with free antispyware software. if the host computer belongs to third party company, you should strongly recommend them to take this issue seriously.
hope this helps and i hope to hear from you soon.

[maresca]

hello there,
the advancedxpdefender infection might be on the computer that hosts your website. if i needed to place a bet, i'd say the host computer is infected, but there's also several other possibilities.
you say you've removed the malicious code from index page, but it might be also inserted anywhere else in the website code. you should look through the code really carefully; i know it might take a lot of time, but it's worth it.
there's also a possibility that the infection is on the computers that are used to develop the website. in this case, everytime someone opens website code from the infected computer, advancedxpdefender sneaks into websites code. either developers computer or host computer is infected, the infection might reach the machine through network connections, so ALL the computer in the network may need to be scanned for parasites.
have you changed the passwords for accessing websites code after the infection appeared? if the attackers have your passwords, they can access the code remotely and do whatever they want.
you can search for malicious files using advancedxpdefender removal tutorial, you can also scan computer with free antispyware software. if the host computer belongs to third party company, you should strongly recommend them to take this issue seriously.
hope this helps and i hope to hear from you soon.

Many thanks Bobby - Lots of valuable feedback there. I'll make a point of acting on all you said there.

Cheers buddy, have a good one  :wink:

[Bobby]

please don't hesitate to ask for further insistence  :wink: