1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Eset Nod 32 found a virus on my wordpress site

Discussion in 'Blogging' started by fifty875, Feb 27, 2012.

  1. fifty875

    fifty875 Junior Member

    Joined:
    Oct 5, 2011
    Messages:
    152
    Likes Received:
    27
    Every time when a visitor with Nod 32 visits my site it says that my website is infected with HTML/ScrInject.B.Gen virus

    I scanned it with sucuri(dot)net and it says:

    Anomaly behavior detected (possible malware).
    Details: http://sucuri.net/malware/malware-entry-mwanomalysp8
    <script type="text/javascript" src="http://analytics.hosting24.com/count.php"></script>

    That is the analyics code from my 000webhost, and I disabled that code. The malware was found on my "about us" page. Anyway I see some activity on my "about us" page. My analytics says that is a unknown spider with ip 118.70.127.134 and Hostname: mail4.bkav.com.vn clicking like this:

    07:58:16 ->/about-us
    07:58:17 ->/about-us/
    07:58:19 ->/about-us
    07:58:20 ->/about-us/

    I installed some security plugins and anti-virus plugin for wordpress.
    Please, there is somebody to help me on how to remove this? I don't want to lose visitors and rankings :(
     

    Attached Files:

  2. fifty875

    fifty875 Junior Member

    Joined:
    Oct 5, 2011
    Messages:
    152
    Likes Received:
    27
    Can someone help me to get rid of that nod32 notification?
     
  3. fifty875

    fifty875 Junior Member

    Joined:
    Oct 5, 2011
    Messages:
    152
    Likes Received:
    27
    Ok, so there is somebody who know how to get rid of malware?
     
  4. dragonworks

    dragonworks BANNED BANNED

    Joined:
    Jul 24, 2010
    Messages:
    173
    Likes Received:
    8
    Looks like you have some code in your wordpress, or some body has installed some code.

    Can you check your blog, whether it is connecting to any url?

    Because usually i see virus in ecommerce, wordpress is very low cases.
     
  5. fifty875

    fifty875 Junior Member

    Joined:
    Oct 5, 2011
    Messages:
    152
    Likes Received:
    27
    How can I check if it's connected with with other URLs?

    I think it's the analytics code from 000webhost, but i disable it. but it's still on after my last sucuri.net scan.

    I only want to have visitors with eset nod32 antivirus on my site again...