Virus on our Website [CLOSED] - Geeks to Go Forums

Jump to content

Log in Register Register Malware removal guide How it works

Virus on our Website [CLOSED] Virus keeps coming back after removing it

#1 jaysonnhs

  • Group: Member
  • Posts: 1
  • Joined: 18-April 08

Posted 18 April 2008 - 03:32 PM

Our website newhomessection dot com has a virus and it keeps coming back. The virus is at the bottom of our index.php pages. We keep deleting it off of several pages but it keeps coming back. We even uploaded a clean site and ??? still comes back.

We use WP (2.5) as a /blog subdomain
bluehost is our ISP but they don't care
Our developer is stumped


Any help would be greatly appreciated -

#2 greyknight17

  • Group: Visiting Consultant
  • Posts: 16,560
  • Joined: 24-April 05

Posted 23 April 2008 - 10:59 AM

Welcome to GTG.

You need to find out how it's infecting your webpage. Could it be that your own files that you uploaded were infected as well? I'm not sure how much we can help out from here...usually the host takes care of that, but since you said they don't even care, it might be time to go with a "real" webhost and not one provided by your ISP. Even a free one will do, just so you can test it out. I think 110mb.com is a free one you can use to try out.

I looked at your site with Firefox and don't seem to have anything alarming here. I do see this piece of code though:

<meta name="verify-v1" content="lQoQFMRwmSLwCkcc4+zckt0EBbuL5ma41dAtuMMTeko=" />
<link href="http://www.newhomessection.com/nav/new-layout/hype-does-valid.css" rel="stylesheet" type="text/css" />
<meta name="verify-v1" content="QY3LWMe9aIH+/gqf/trWJfFojcQJPd6We0PaoYkOlLs=" />


Do you know what that's for? The middle line is for your stylesheet, but the other two look very suspicious. See if you have that on your own computer files. If so, you need to remove them first and then upload them back.

#3 greyknight17

  • Group: Visiting Consultant
  • Posts: 16,560
  • Joined: 24-April 05

Posted 01 May 2008 - 07:13 PM

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

Share this topic: