Sorry to hear about your sites troubles, you're welcome to email security@dnnsoftware.com but I’m afraid we typically can’t offer much help for virus’s on websites.

Typically when a site has virus files added to it, it happens in one of four ways

·        An upload vulnerability with the sites code (i.e. DNN) – this does not appear to be the case, unless the hackers have found an issue that we do not know of. However (to date) no-one else has reported a similar problem, suggesting that this is not the case.

·        A server level issue e.g. missing Microsoft patches or an issue with a 3^rd party tool on the server (such as plesk or a mail server) that has meant the server is compromised – the exploit will then drop copies of the payload into various locations (often these are semi-intelligent and search for directories such as “portals” [for dnn] or “wp_content” [for wordpress] etc.). I’d recommend checking with your hosting provider to see if other sites on the server have been exploited

·        The virus originated from someone with access to the sites files e.g. either via FTP or windows explorer. Looking into the QuidVetis.A virus shows it’s based on the Blacole kit. I’ve seen a number of Blacole based virus’s that used FTP to spread e.g. they get onto the developers machine and a background process looks for any requests outbound on an FTP port. When one occurs they capture the username/password and then use that to upload the viruses silently. This can typically be verified by looking at the IIS logs, and if that’s it you’ll have to sanitize the users local machines as well as fix the site and change the ftp details.

·        A 3^rd party module with an upload vulnerability – you can check your IIS logs and see if they show anything (look at the timestamps on the virus and try to associate it with the same timeframe in the logs – take care to factor any timezip/utc offsets)

Thanks,

Cathal

DNN Security team