Have you ever had one of those days? One that you would like to wake up and find out it is all a dream? I have gone thru a horrible two days and I am ready to tell you about it. What happened to me is something that all web designers fear.
My QuiltCampus website was hacked and it took forever to fix the problem.
It all started with an email from a customer that they were getting a malware warning when visiting www.quiltcampus.net. Then I got another email from another friend “I’m getting a warning that your page contains malware. Thought I’d let you know”. I of course freaked out. There is nothing like having your web site hacked. It is like being violated.
I got with tech support on the issue and their response was
Permission set of files confirm this is an FTP based hack.
Here are immediate measures you should take:
1. Scan all computers that have FTP access to this account, or have had access to it in the past. This is to be done until an infection is found and cleaned.
2. Change password of the main and the sub-FTP account.
3. Re-upload fresh/un-infected files.
Re-upload the infected file? Geeze! Which one? QuiltCampus’ web site is composed of over 8000 files.
I never found any virus on my computer, so I wiped it and restored an image I made of it about 4 months ago. I spent several hours reloading and updating software that was done after that image. I changed my FTP password on all my websites and started to re-upload html files at my web site that I had uploaded in the past week. I spent 10 hours that day working on the problem.
After all that work, I asked my friend to see if she was still getting the malware message when visiting my website. Her response was “Yes, for that page and even for your home page. I’ve attached a copy of the window that comes up.”

I contacted tech support again to let them know I did all they asked and there is still a problem.
There response was “You can run google safe browsing test on quiltcampus.net. Which shows your site clean.”
I had already run a google safe browsing test and found the same results.
But then I got two more emails from customers.
” I tried to view your website but got the following error message: The page you are trying to access has been identified as a known exploit, phishing, or social engineering web site and therefore has been blocked for your safety. Without protection, such as that in the AVG Security Toolbar and AVG, your computer is at risk of being compromised, corrupted or having your identity stolen.”
“When going to the QuiltCampus site a malware warning pops up. You better have your site checked out. Pretty scary.”
There is a problem here! Tech support can not find it.
I did a search on the phrase “simpleworldhouse.ru hack” at google and came up with …
http://blog.unmaskparasites.com/2009/12/23/from-hidden-iframes-to-obfuscated-scripts/
This is a recent article about web site hacks like the one at my web site. After reading the article, I starting searching the web pages visitors got the warning with. I just could not find the special script mentioned in the article in any of those web pages.
I downloaded my whole website to my hard drive. Boy! That took forever! QuiltCampus’ website is over 200meg in size. I did a search on all the files for the phrase “GNU GPL”. There it was in the fw_menu.js file. I forgot all about this file. It runs the side menu bar for the web site. That is why the warning message showed up all over the place for visitors. Most of the web pages access that file.
I re-uploaded the correct fw_menu.js file and had my friend check the website again. She reply’s “I’m going through as many pages from QuiltCampus as possible (the links on the home page and the drop down menus for each) and the warning window is gone from some of them where I got it before. However, it still comes up for these pages. (she list pages here)”
As the article mentions, the hacker also changes index.html files. Geeze! I have almost 200 index.html web pages in about 300 folders. So I painstakingly went thru each folder and sub folder and re-uploaded all files that were changed on 12/20/2009. That was the day of the attack. Every single index.html file had been altered.
After two 10 hours days, the website is now fixed. This is one tired designer. I think I need a vacation!
oh, my friend that helped me thru this. She is a geek and a quilter! You can visit her site

http://mariamichaelsdesigns.com/
Two of the emails I received after this attack, I was not able to respond to. One was lost when I wiped my computer and one was sent with out an email address. I want to thank everyone that emailed me when they found a problem with my website.
Update – 12/30/09 11:30am central time
I thought it was fixed but there are still Trojans. I have wiped all the files at www.quiltcampus.net. If you try to visit any of the web pages, you will get a page not found error message. The only exception is the home page where I put up a note that the site is down. I will spend the next few days rebuilding the site from scratch. I will keep you posted of my progress.
Sites that work are
programs.quiltcampus.net – EPP workshops
workshops.quiltcmapus.net – Guild workshops
blog.quiltcampus.net – My blog
Sites that *DO NOT* work are
class.quiltcampus.net – class forum and gallery
www.quiltcampus.net – main web site
Update – 12/30/09 4:30pm central time
Ok folks….I need encouragement here. I am so distraught about all the time I will be spending to fix QuiltCampus. Sometimes tech support of one is good for you know all that is going on. But when the poo poo hits the fan, it can be very overwhelming. Do me a favor; leave a post cheering me on. I think I can … I think I can. 8o)
Update – 12/30/09 6:30pm central time
I just got done copying all my data files to Topcat, our file server. Yes, we have a file server at home…hehe. That is what every geeky hubby has to have. This took about 1-1/2 hours to complete. Earlier today when I tested my website, a trojan was downloaded to my computer. My virus program caught it, but you never know what may have been sliding down with it. I am now going to wipe my computer and restore the image I made 4 months ago. This will take about 2 hours. During this time I will see about supper. Yall have a great night.
Update – 12/31/09 11:00am central time
Sorry for the late update. Right out of the blue last night, I got very ill. It was like the sensation of food poisoning. I do not get sick often, but when I do, I really get sick. I took some nausea medication we keep on hand provided by our doctor. It works great, but also knocks me out. Here it is 11am and I am still half asleep. I will take it nice and slow today. I do not feel sick like last night, but I am tired and have some pretty sore tummy muscles. The image restore to the computer went find last night and I just got done transferring my data files back to my computer. My kitties are fed and I still need to do the litter boxes (I know, I have way too many cats…hehe). After that, I will see about getting the CD Designs newsletter out and then start copying the core files online for QuiltCampus.
Update – 12/31/09 3:30pm central time
I got CD Designs newsletter going out and then I went and took a nap. That medicine really drags me down. But the good think is I had a nice lunch and now I am going to start uploading files to QuiltCampus.
Update – 12/31/09 6:10pm central time
The core files for www.quiltcampus.net have been uploaded. This means you should be able to visit any web page on the site except the protected areas, class forum and class gallery. The protected areas take special care to upload for they contain the .htaccess files. These files are used to talk to the apache program on the web server. They request a login to access the files in that area of the web site. I have to upload them one-by-one so I can change the CHMOD for each. The CHMOD setting provides the permissions allowed by the web site visitor. Can they read the file, rewrite the file or execute the file. I think I will save this till tomorrow. Yall have a great night!
Update – 12/31/09 7:15pm central time
Well Geeze! I thought I was done for the night. Then someone let me know that CD Designs was hacked too! So I went ahead and deleted CD Designs web site and uploaded it again. It is much smaller than QuiltCampus and does not have any installed scripts. There were only 3 .htaccess files to deal with. Therefore it was much easier to fix. However, it did take an hour to re-upload the 1300+ files. Now I am going to call it a night and go see about supper.
Update – 1/1/10 10:15am central time
Good morning and Happy New Year! My friend tested the QuiltCampus web site and I am happy to quote her report. “What a lot of work! You’ll be happy to know that I used every working link on your home page and they all came up beautifully! No warnings anywhere!“. Thank you Maria! When I saw her email come thru, I was so scared to read it. The last few she sent me was to inform me the problem was still there. Since I have the core of QuiltCampus fixed, I am going to jump tracks and catch up on some business things that have been piling up the last few days. After that, I will see about re-uploading and setting up the protected area of QuiltCampus. That will be this afternoon or tomorrow. Thank you all for the encouragement and the support. It really helps me to keep going. Please keep posting!
Update – 1/2/10 5:00pm central time
I have the protected section of the web site up! That went pretty smooth. Just a little tedious changing the CHMOD settings for each the .htaccess files. Next will be the class forum and class gallery. I have to reload the scripts from scratch and then link the two programs together so that they use the same username list. If I am lucky, I will be able to salvage the old databases. I am going to save this task for latter when I am fresh and ready for a challenge. We are slowly getting there! Thank you so much for the support!
Update – 1/19/10 12:30pm central time
There is good news and bad news. The good news is the class forum is now working! The bad news … I still do not have the class gallery up and running yet. I hope to have it fixed soon. 8o)
Update – 1/19/10 5:20pm central time
The class gallery is now online. I had to do a lot of “cut and paste” so I hope it is back to normal. Cross your fingers for me.
cindy aka MsDesigns