I have a problem with a malware/virus that i have found on a website that i manage. I have not found any solution online, I hope that You can help me.
First of all, this virus had inserted on the homepage this block of code:
<div id="urlss-20140430-01" style="/* display: none; */">
<strong>
<a href="http://www.careertechnj.org/bans.php" title="cheap ray ban sunglasses">ray ban outlet</a>
<a href="http://technainstitute.com/wsunglass.php" title="cheap oakley sunglasses">cheap oakleys</a>
<a href="http://www.conama.org/code.php" title="oakley sunglasses cheap">oakley outlet</a>
<a href="http://ciocp.ro/fake.php" title="ray ban sunglasses sale">ray ban sale</a>
<a href="http://www.quadrifoglio.org/cheap.php" title="ray ban sunglasses cheap">ray bans cheap</a>
</strong></div>
Moreover, there is a file that generate continuously a file "cheap.php" that contain a row of code that get the contents of a website that advertises ray ban sunglasses.
If a try to cancel this generated file, after a second the file is generated again.
In addition, some of the files that were on the server, have been eliminated. But I do not know if this depends by the same virus.
Have you ever stumbled across this malware?
Please help me.
Thanks
It can be difficult to find the cause if your server has been compromised depending on the level of sophistication. You can use a service like sucuri, they have a free scanner on their homepage and will clean your site for you if your willing to pay.
Alternatively if you have all of your source code hosted somewhere else (maybe a local copy) you could delete all of your files and re-upload them. Even better would be to change server or web host to ensure peace of mind.