PHP and Viruses

[shaya]

I set up a MySQL database and a very simple PHP script to let an aquaintance go in and send a pretty html email to contacts in the database–she can open a web page interface and type in the text, which gets stored in a variable and inserted into the formatted html email. We did a test run, and one of the recipients said her virus software flagged the message as having a virus. Nobody else, self included, had a problem. The interface page is protected with a http header password.

Is it possible for a third party to attach a virus to an email as it travels through cyberspace? At what point would it happen? I called GoDaddy (hosting service) and they said to reset passwords on both my ftp access and the database to something much more secure, and to delete and replace the PHP file. They said it is possible for a hacker to use some sort of program to figure out your ftp password, and get in there and attach a virus.

I downloaded the PHP file to my computer and ran it through virus check (AVG) and it was fine.

I am very ignorant about what a virus actually is. Is a virus code someone types in your file–like they open your PHP text file, type something in, and save it to the server. Or is it a separate .exe file that they upload, and then somehow reference or call from the PHP file…in either case, doesn this sound likely or is it probably a quirk with this particular user’s virus software, that it didn’t like something about the email?

Any light anybody can shed, much appreciated.

[TheDoc]

Well, always use a secure password for your FTP. A lot of times people will go with something they know they’ll remember, don’t do this. Go for something cryptic, like:

Gry12$9u8xx

Then make sure you put all of your passwords in a file on your computer somewhere (AND BACK THAT FILE UP SOMEWHERE ELSE!).

But to the point at hand… once an email is sent, that’s it. Something can’t be added to AFTER that point. Someone could, I suppose, write a virus that could attach something as it’s being sent, but that is definitely not the case in this instance, I can assure you.

Everybody’s email provider has their own type of spam protection. Sometimes the spam protection software can improperly target an email as spam, and flag it. Then, if the email has been flagged by the mail server, a user’s Virus Protection program will look at the flagged email and assume virus. Only a possibility.

It’s doubtful you’ll every really find out the answer here. I’d do exactly what GoDaddy said. Update your passwords, reupload the file. It may seem silly to do, but there’s no harm in being a little safe. Then, try sending it again. If the same thing happens, and only to that particular user, you’ll know it’s her issue, not yours.

[Author]

Posts