You have a malscript right after your opening body tag.

It starts with: < sc rip t>q="=hgs…</s cr ipt>

This obfuscated code creates an infectious iframe that points to d0lphin. biz

You might have a virus on your PC since you stated that you removed this page from your site, then added it back again.

These viruses know how to steal FTP credentials – username and passwords, by a few different methods.

First, the virus knows what files the popular FTP programs store their saved passwords. The virus searches for those files and steals all FTP credentials and sends them to a server controlled by the cybercriminal.

Second, the virus can also view the FTP traffic as it leaves your PC and sniffs the FTP credentials that way because FTP transmits all data in plain text.

Third, the virus can use the infected PC to inject it’s malscripts into the FTP traffic as it leaves your PC. This is evident in the logs we’ve seen where the only FTP traffic was from a known source.

Fourth, the virus is also a keyboard logger. This allows the virus to steal all login information as you type it on your keyboard.

The viruses have been fast and furious and able to evade detection when they are first released and then they’re smart enough to detect the current anti-virus software and evade detection from there as well.

What you need to do is to install a new anti-virus program on each PC with FTP access to your site – even outside developers if you use any.

Many have had good success with the free versions of: AVG, Avast, Avira or Malwarebytes. If you already use one of these, then select another to install but it has to be something different than what’s currently being used.

Then scan each PC and remove any and all viruses and trojans.

Then you can upload clean files to your site if you have a good clean back-up. If you don’t have a known good back-up then you’ll have to edit each file. These malscripts are usually only in index.* files and are inserted immediately following the opening body tag and are iframes so they’re easy to spot. Remove the entire iframe from start tag to end tag.

Then you can upload to your site and your site has probably been flagged by Google so you’ll have to login to your Google Webmaster Tools and request a review – not a reconsideration, but a review.

Then just wait. You should be clean after that.

We have blogged about this: http://www.wewatchyourwebsite.com/wordpress/?p=228

Thomas J. Raef
“We Watch Your Website – so you don’t have to!”
http://www.wewatchyourwebsite.com
traef@wewatchyourwebsite.com

Do you know what this script on [ www .duga-vrtic .hr ] does?

<scr>q="=hgs`ld!rsb<iuuq;..e1mqih . . .

Something related to that page is referencing [ d0lphin .biz ] which is bad.

Edit: I see I wasn’t quick enough … you are in good hands with WeWatch. :-)

Edit again: To add one more thing. At the present time, Google is not flagging your site. Your browser is alerting you to a cross-site scripting issue. As long as Google does not flag your site with “This site may harm your computer” in the search results, you will not need to “Request a Review” through Webmaster Tools.

Removing this script, and preventing it from coming back, should clear the browser warning.