Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There appears to be a virus on my site. It's been there for some time and I've had no problems as yet. AVG picks it up, but McAfee does not.

I run a website (sortitoutsi.net) Ages ago I got a virus on my computer, which got a hold of my FTP passwords and added some lines of JavaScript to the top of my site.

I removed them and believe it was fixed. However, using the "Web Developer" extension for Firefox I found that the JavaScript on my page was pointing various links to such URLs as:

  • gittigidiyor-com.excite.co.jp.webmasterworld-com.eastmusicdirect.ru:8080/aboutus.org/aboutus.org/google.com/skycn.com/torrents.ru.php

  • gittigidiyor-com.excite.co.jp.webmasterworld-com.eastmusicdirect.ru:8080/index.php?jl=

These terms do not appear anywhere. In the source code, in any of the JavaScript or the CSS. I also can't see any unrecognizable rogue images.

I have no idea where this JavaScript is coming from.

Can anyone suggest how I can find references to these links and remove them?

I can see them both in the Web Developer Firefox extension and in the net tab using Firebug.

Any help would be greatly appreciated.

share|improve this question
@Rob - stackoverflow is a forum for programming questions only. Your question will probably get migrated to ServerFault.com which is a better forum for sys admin type questions. –  Oded Mar 14 '10 at 21:14
Have you tried to clear the cache in your web browser? –  Mikael S Mar 14 '10 at 21:15
Can someone edit out the urls so some new comer doesn't come by and load them? –  MrStatic Mar 14 '10 at 21:28
Why was this question moved here, and not to serverfault.com ? –  Jørn Schou-Rode Mar 14 '10 at 22:00
@Josh - Don't vote to migrate the question back to SO, it just creates a duplicate. Instead flag the post for moderator attention. –  ChrisF Mar 24 '10 at 22:26
show 3 more comments

migrated from stackoverflow.com Mar 14 '10 at 21:15

This question came from our site for professional and enthusiast programmers.

2 Answers

I don't see how they could have rootkit on the machine, after all I have 20 sites on this machine and only one site has been effected.

I also don't see how this could let them output javascript on a page. Surely in order for the browser to download it, it has to be somewhere in the javascript and not an actual server issue.

Could you explain a little more why you think a complete clean machine would be necessary?

EDIT: I posted this question as a guest over at stackoverflow and it seems to have lost the fact that this is mine in the migration. I realise this is now messy but I can't respond to answers. If someone knows how to fix it please let me know.

share|improve this answer
Whenever a machine is compromised you shouldn't trust it. Rootkits are designed to be hidden, and if binaries were replaced they could hide processes doing nefarious things; if you have a trojaned ps, how can you use ps to figure out if you have another malware process running? –  Bart Silverstrim Mar 14 '10 at 21:57
@Ssv - you only need the first three characters of the user's name for them to see a comment directed at them, and as this is Rob's answer anyway he'll see it anyway. –  ChrisF Mar 14 '10 at 22:53
@Chr - Thanks! I didn't know the exact syntax. Where can I find this type of information about SuperUser? –  ssvarc Mar 15 '10 at 1:29
Have a look at meta.stackoverflow.com where there is all sorts of interesting information about the trilogy ;-) –  Ivo Flipse Mar 15 '10 at 6:10
@Ssv - as Ivo pointed out (but forgot to add your user id) check out meta.stackoverflow.com –  ChrisF Mar 15 '10 at 9:01
show 1 more comment

Check the top and bottom of the http://sortitoutsi.net/template/js/general.js file ...

looks pretty suspicious to me..

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.