think my website got hacked.

[EdgyRabbid]

So i was editng my website tonight, making some edits,, then my website got flagged as unsafe, and i got blocked from editing it.

Then, i went on another web browser, and got the pop up below. I had a virus called something like "Malware.AI" from a program i had downloaded for weeks. i dont know if the two had any corralation but stay safe!

[ThunderPerfectWitchcraft]

Just opened your website; no pop-up for me. The only thing that I noticed is that your ssl-certificate is broken, and that you load an ungodly amount of scripts (31 sources), but it seems all harmless, so I guess this is intented.

Regarding your pop-up, I assume that it is the precaution by your webspace-provider, and wouldn't gauge it as a problem in itself, although this is hard to tell.

What steps did you do to get rid of the malware? Basically, the only way to be safe is to do a clean reinstall of the whole OS.

[EdgyRabbid]

Just opened your website; no pop-up for me. The only thing that I noticed is that your ssl-certificate is broken, and that you load an ungodly amount of scripts (31 sources), but it seems all harmless, so I guess this is intented.

Regarding your pop-up, I assume that it is the precaution by your webspace-provider, and wouldn't gauge it as a problem in itself, although this is hard to tell.

What steps did you do to get rid of the malware? Basically, the only way to be safe is to do a clean reinstall of the whole OS.

first of all, i need to fix that.

2, i contained the virus using malwatebytes. it was deceted as "malware.ai", i tried to google it but to no luck. strangly the virus came from a program ive had for the past month, and i geninly have no idea why it wasnt dedcited until now.

[AnIzzi0t]

yeah, it says your site is unsafe from my main browser, firefox

opening it in a different browser, things seem normal, besides the pop up that says "this page has been blocked by an extension," which im assuming is the malware

thankfully, the rest of your website seems normal and untouched. try to get into contact with the hosting service, maybe?

[MediocreMetastasis]

@AnIzzi0t Firefox usually throw warnings for websites if there's something wrong with the https certificate or if there's no certificate at all. If it's a website that is known to contain malware your ISP usually blocks it. (Pro tip if you press Advance a button will pop up saying "accept risks and continue" which lets you unblock the site and it tells you why it's block).

Firefox says it's a bad certificate. If you're not self hosting it's an issue with your host.

[Dan Q]

The SSL error is probably not a problem, as others have said. It occurs because your webserver is saying "I am vps.fifo-f.eu", instead of "I am edgyrabbid.space". The former is the name of your actual server, rather than the name of the website. Most-likely, this is just a configuration error.

The way (modern) HTTPS works is a web browser says "I'm looking for edgyrabbid.space", and then the server decides (a) whether it hosts that website and (b) what SSL certificate to use. Your server DOES know that it hosts the website (and the website's all there!), but isn't choosing the right certificate. That's all. It can be fixed by your host!

The popup you're seeing isn't appearing for me or for other people, so it's probably something on your computer, not on your site. It could be actual malware, or it could be some program trying to trick you into installing actual malware, but the important thing is not to panic, run a trustworthy virus scanner, and make sure your backups are good (ideally; check a backup by looking at it on a different computer, although don't run anything from that backup on that different computer until you're happy with the results of the virus scan!). It's also possible that it's a false alarm: "Malware.AI" is a generic term that does not refer to any specific malware but means "your antivirus program found something that LOOKS like malware, but might not be".

So in summary:

1. Slow down. Don't panic.
2. Check your backups (ideally from a different computer, without running anything in them).
3. Run trustworthy antivirus software.
4. For the SSL error: it's probably unrelated, speak to your host about the fact that the incorrect SSL certificate is being used for your domain.
5. Did I mention not panicking?

(And let me know if you need any help. I'm literally "your local neighbourhood computer security specialist" with like 20+ years of experience, my third degree is a masters degree in information security and digital forensics, I've worked in ethical hacking and penetration testing and security hardening, etc. Malware analysis ain't my specialism, but I'm close enough/adjacent.)

[EdgyRabbid]

Hey guys, Update:

The SSL is fixed. I still dont know why that happened.

and the virus is gone, i still dont know what it was. It was from a FL Studio crack my friend had sent me, and it was from a few weeks ago.

And for the pop ups, it might be from one of my scipts?? Its only appearing on certain pages, like the front page. There would also be a thing where if you clicked on the "webrings" buttons, it would lead you.. to a gambling site? Im gonna double check all the scipts, cuz i didnt put anything on there.