: How to clean PmWiki from JS:Includer-AWG and protect my site from future infections? I'm hosting a site for an NGO for several years now. The site seems to be based on a PmWiki backend. I

Posted in: #Javascript #Security #Server #Trojan #Wiki

I'm hosting a site for an NGO for several years now. The site seems to be based on a PmWiki backend. I don't know much details because I'm just hosting the site and I'm not the guy who set it up.

I would not ask but the one who created this site several years ago is not available for help currently.

Now people called me up and told me their antivirus software is reporting the site as infected with some kind of javascript based trojans, called "JS:Includer-AWG (Trj)". What is this and how to get rid of it?

I tried to at least find out the installed version of PmWiki but couldnt find any details or a version string on the server.

My main interest now is also to protect the site from future infections. Is this a PmWiki vulnarability? Is my webserver hacked? Where to start?

I have already changed passwords and tried to delete malicious JS files but I want to avoid this to happen again.

Update1:

Quttera.com says "No malware detected"...
Yandex.com lists the torjan as "Troj/JsRedir-NN" (data provided by Sophos).
Sucuri.net says "Website blacklisted" and "compromized".

Update2:

This site is running pmwiki-2.2.17 (VersionNum=2002017).