View Single Post
Old 07-12-2015, 12:52 PM  
hdbuilder
Confirmed User
 
hdbuilder's Avatar
 
Industry Role:
Join Date: Jun 2012
Location: Canada
Posts: 1,338
It usually comes all from a single php file that reupload the bad files you see when you delete them and reinsert nasty codes into your html files.

Open one of your site and look at the source code of the page, check it without javascript enabled if your afraid of getting a virus, find an include which don't belong there, if it's encoded with eval (most of the time), decode it here HTML & JavaScript Encoder/Decoder.

Then look at the path of the php include file inside that code. Find that file and delete it (its the main file). Then run ComboFix on your computer to make sure you don't have any backdoor virus. That you got while watching porn

Then change your FTP, Cpanel (whatever), root password for your server.

Got those a few times and this is how i got ride of them...
hdbuilder is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote