How to Remove this http://kdjkfjskdfjlskdjf.com/kp.php torgen

Discussion in 'Site & Server Administration' started by qasimbilal, May 4, 2010.

  1. #1
    Hi
    I have a website (not wordpress, not joomla) hosted on GoDadday. Yesterday i checked and found this virus on my website.
    I have tried to remove this but i could not find this in .php pages. But when i browse the url and open the page source there is http://kdjkfjskdfjlskdjf.com/kp.php at the bottom of the page.

    please help me how i can remove this from my website. my domain name is studiesinn.com
    thanks
     
    Last edited: May 4, 2010
    qasimbilal, May 4, 2010 IP
  2. qasimbilal

    qasimbilal Member

    Messages:
    25
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    36
    #2
    My website domain is studiesinn.com it has virus script on each page except home page.
     
    qasimbilal, May 4, 2010 IP
  3. crashus

    crashus Active Member

    Messages:
    90
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    53
    #3
    You probably can use some simple console script to wipe that lines out but are you sure you're secured everything so this will not happen again?
     
    crashus, May 4, 2010 IP
  4. Blue Star Ent.

    Blue Star Ent. Well-Known Member

    Messages:
    1,989
    Likes Received:
    31
    Best Answers:
    0
    Trophy Points:
    160
    #4
    Go see this thread : LINK


     
    Blue Star Ent., May 4, 2010 IP
  5. ryan1918

    ryan1918 Active Member

    Messages:
    668
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    60
    #5
    I can help you guys, contact me via pm or email (ryan AT ryan1918.com) If I fix everything just throw a link to my site up or gimmie a few bucks via paypal.
     
    ryan1918, May 5, 2010 IP
  6. nikb

    nikb Peon

    Messages:
    93
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #6
    Have you tried searching something with base64_ in your php pages?
     
    nikb, May 6, 2010 IP
  7. mubashirnisar

    mubashirnisar Banned

    Messages:
    2,186
    Likes Received:
    22
    Best Answers:
    0
    Trophy Points:
    0
    #7
    i can help you remove this trojan,recently i cleaned one of my client's blog on godaddy,and i know it is actually godaddy host problem,and i know how can you remove it,contact me if the problem is still there

    thanks
    kind regards
     
    mubashirnisar, May 6, 2010 IP
  8. extremephp

    extremephp Peon

    Messages:
    1,290
    Likes Received:
    32
    Best Answers:
    0
    Trophy Points:
    0
    #8
    it can never be Godaddys problem... and it will be a hosting malware spread all aroung your files which was once spread from one of the files you uploaded..!

    :)
     
    extremephp, May 6, 2010 IP
  9. Blue Star Ent.

    Blue Star Ent. Well-Known Member

    Messages:
    1,989
    Likes Received:
    31
    Best Answers:
    0
    Trophy Points:
    160
    #9
    So you are saying their own computer infected their web site. Is that right ?


     
    Blue Star Ent., May 6, 2010 IP
  10. mubashirnisar

    mubashirnisar Banned

    Messages:
    2,186
    Likes Received:
    22
    Best Answers:
    0
    Trophy Points:
    0
    #10
    so you are saying that 100 of peoples got there computers infected with same kind of viruses?
     
    mubashirnisar, May 7, 2010 IP
  11. qasimbilal

    qasimbilal Member

    Messages:
    25
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    36
    #11
    Hello!

    thanks guys. I have removed the virus. There was a script on some pages of my website starting <?php base64_...
    thanks for your help
     
    qasimbilal, May 10, 2010 IP
  12. ryan1918

    ryan1918 Active Member

    Messages:
    668
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    60
    #12
    It could of been a mass hack, all go daddy sites, or certain ip or domain, could of been many reasons.
     
    ryan1918, May 13, 2010 IP
  13. Mike-XS

    Mike-XS Greenhorn

    Messages:
    28
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    13
    #13
    Mike-XS, May 14, 2010 IP
  14. Ndoki

    Ndoki Peon

    Messages:
    3
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #14
    I found a free removal instruction at DigitalDrake.com. See "Recent Post" on that site.
     
    Ndoki, May 30, 2010 IP