Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There appears to be a virus on my site. It's been there for some time and I've had no problems as yet. AVG picks it up, but McAfee does not.

I run a website ( Ages ago I got a virus on my computer, which got a hold of my FTP passwords and added some lines of JavaScript to the top of my site.

I removed them and believe it was fixed. However, using the "Web Developer" extension for Firefox I found that the JavaScript on my page was pointing various links to such URLs as:



These terms do not appear anywhere. In the source code, in any of the JavaScript or the CSS. I also can't see any unrecognizable rogue images.

I have no idea where this JavaScript is coming from.

Can anyone suggest how I can find references to these links and remove them?

I can see them both in the Web Developer Firefox extension and in the net tab using Firebug.

Any help would be greatly appreciated.

share|improve this question

migrated from Mar 14 '10 at 21:15

This question came from our site for professional and enthusiast programmers.

Have you tried to clear the cache in your web browser? – Mikael S Mar 14 '10 at 21:15
Why was this question moved here, and not to ? – Jørn Schou-Rode Mar 14 '10 at 22:00
@Jørn closing - which encompasses migration - is decided on a majority vote of 5 users. If there's a tie then the first vote wins. – ChrisF Mar 15 '10 at 9:04

I don't see how they could have rootkit on the machine, after all I have 20 sites on this machine and only one site has been effected.

I also don't see how this could let them output javascript on a page. Surely in order for the browser to download it, it has to be somewhere in the javascript and not an actual server issue.

Could you explain a little more why you think a complete clean machine would be necessary?

EDIT: I posted this question as a guest over at stackoverflow and it seems to have lost the fact that this is mine in the migration. I realise this is now messy but I can't respond to answers. If someone knows how to fix it please let me know.

share|improve this answer
Whenever a machine is compromised you shouldn't trust it. Rootkits are designed to be hidden, and if binaries were replaced they could hide processes doing nefarious things; if you have a trojaned ps, how can you use ps to figure out if you have another malware process running? – Bart Silverstrim Mar 14 '10 at 21:57
@Ssv - you only need the first three characters of the user's name for them to see a comment directed at them, and as this is Rob's answer anyway he'll see it anyway. – ChrisF Mar 14 '10 at 22:53
@Chr - Thanks! I didn't know the exact syntax. Where can I find this type of information about SuperUser? – ssvarc Mar 15 '10 at 1:29
Have a look at where there is all sorts of interesting information about the trilogy ;-) – Ivo Flipse Mar 15 '10 at 6:10
@Ssv - as Ivo pointed out (but forgot to add your user id) check out – ChrisF Mar 15 '10 at 9:01

Check the top and bottom of the file ...

looks pretty suspicious to me..

share|improve this answer

You must log in to answer this question.