Hey guys

a clients site of mine has Malicious code inseted and I can't work out how to remove it. I have tried searching for it but can't find it.

I have confirmed with web-sniffer.net/ (used googlebot) via the drop down menu and can see hundredss and hundreds of external links.

Has anyone experienced this? I have searched all the main files such as index.php / footer.php / header.php etc and can't find anything wrong.

The site is no longer appearing google via the keywords, and now also has a caution next to it when the domain name is entered is google direct.

The domain name www.strathfieldonline.com.au

where else can the information be stored and how do i remove it.

I appreciate everyones time

thanks

Well it is being inserted after

<!-- footer_eof //-->

So you need to be looking around there in your code.

Drive-By Downloads (what's this?) Threats found: 1
Here is a complete list:
Threat Name: HTTP Fake AV Redirect Request Location: http://www.strathfieldonline.com.au/index.php

First of all you will need to look around your files on your server. Look for any new and large files that shouldn't be there. Also look for any open chmoded 777 folders. These need to be protected by either a htacces file or by changing the permissions of them back.

If you find any of these files then chances are they have come from an unsecure script that your website is using. Is there an upload box allowing php files to be uploaded?

Hey thanks for everyones input. deffantly something i'll be looking into later on today.

I just got a question.

I have spoken to my hosting company and they told me that, that version of ecommerce is out of date and i should update it asap to prevent it happening again. is that true?

also is there any way of doing a search through ALL FILES for <!-- footer_eof //--> what program can i use to do that??

I have searched many many files and i can't find it??

thanks again for your help

really do appreciate it.

that version of ecommerce is out of date and i should update it asap to prevent it happening again. is that true?

No idea, what version are you using?

index.php is where you will find the code

PHP Code:

<!-- footer //-->
<?php require(DIR_WS_INCLUDES . 'footer.php'); ?>
<!-- footer_eof //-->
<br>
</body>
</html>
<?php require(DIR_WS_INCLUDES . 'application_bottom.php'); ?>

Oh change any and ALL FTP passwords and make sure that every machine that has had FTP access is scanned for trojans.