My website is infected with JS:ScriptIP-inf [Trj]

[rizwanrajput]

I am using Network Solutions hosting. I was recently attacked with JS:Illredir-S [Trj], I asked my hosting providers to clean it and they cleaned it and updated all passwords, but now after a week my site got infected again with JS:ScriptIP-inf [Trj].

Can anyone please suggest me how to secure my website properly ? Should I change my hosting provider ? I am fed up of these viruses again and again on my websites. I can't even find this virus in my files.

Please post informative answers. Thanks

[chathura86]

i dont know much about rhis virus, if you have any file upload forms in the site make sure to validate uploaded files and also escape any especial characters from form submissions

Regards

[rizwanrajput]

My sites are :

https://www.edesimusic.net

https://www.juraatmedia.com

https://www.hotwallpapers.pk

None of them have any upload feature for guests.

[Atli]

Hey.

The two things I would start checking if I had this problem would be:

1. Viruses on my own PC. I use FTP and SSH applications to interact with my servers, as well as typical website access to control panels. If my own computer got infected, it is entirely possible that passwords I use to access those services would be comprimized, giving attackers unlimited access to my servers.
2. Insecure forms in my websites, especially those accepting files or text visible to the public (like blog comments). Improperly processed, such data can be manipulated to do anything from adding XSS scripts to damaging your databases or the website itself.

If those check out, I would start to take a closer look at my host. They may well be less secure than advertised.