My wordpress site infected by JS:Redirector-NT [Trj], please help

[moonheart]

Can u give us a screenshot of the alert.

Here is the screenshot of Avast alert when I try to open the site hxxp://coolmathgamesonline.net.

[moonheart]

Hey! u are using a old version of avast! download the latest free version from here:

http://www.avast.com/free-antivirus-download

Yes you are correct. That is one old version. But now I attached the screenshot of new avast antivirus alert when I try to open the site coolmathgamesonline.net. I installed the new avast by uninstalling the old one few hours back..

[true indian]

hxxp://coolmathgamesonline.net/wp-content/themes/NextWPA/js/jquery-1.2.3.pack.js

It seems like that the problem.

[moonheart]

hxxp://coolmathgamesonline.net/wp-content/themes/NextWPA/js/jquery-1.2.3.pack.js

It seems like that the problem.

I just downloaded my theme, plugin and other correspondent files and then scan with new avast antivirus but no any threat alert shown. How will I distinguish the threat now?

And the strange thing is when I open the site first time on my browser threat shows, but later when I open the homepage or other pages threat does not show.

[moonheart]

hxxp://coolmathgamesonline.net/wp-content/themes/NextWPA/js/jquery-1.2.3.pack.js

It seems like that the problem.

Hi it seems that you are from India. Can we please discuss my problem through chat for the first response. Sorry moderator if this is wrong, please delete my reply.

[kbuleon]

Hi guys,

Thanks for your wonderfull advices. I had my Wordpress infected.
I removed manually the infected files, but i'm not sure i removed all of them.
Now http://sitecheck.sucuri.net says its clean.

But, yesterday after i finished i had an avast alert. Not sure if that was a remaining cache file infected or if the trojan is still here.

My web site : http://www.regardsurlemonde.fr/blog/

How do you proceed to know the differents files infected ?

Can you tell me if its clean or not now ?

regards

[Pondus]

Hi guys,

Thanks for your wonderfull advices. I had my Wordpress infected.
I removed manually the infected files, but i'm not sure i removed all of them.
Now http://sitecheck.sucuri.net says its clean.

But, yesterday after i finished i had an avast alert. Not sure if that was a remaining cache file infected or if the trojan is still here.

My web site : http://www.regardsurlemonde.fr/blog/

How do you proceed to know the differents files infected ?

Can you tell me if its clean or not now ?

regards

you should start your own topic as helping multiple users in same topic will be chaotic
attach a screen shot of the avast warning if you still have problems

HTML scan at VT say clean
https://www.virustotal.com/file/8dc746e23e59282e7cd94f5cd108d41f4bebf2d391d8126313b9f9404b6c13ed/analysis/1328800214/

urlQuery say suspicious
http://urlquery.net/report.php?id=20147

[polonus]

Suspicious code here:
-www.regardsurlemonde.fr/blog/wp-content/plugins/pointelle-slider/js/jquery.cycle.js?ver=1.1 suspicious
[suspicious:2] (ipaddr:213.186.33.19) (script) -www.regardsurlemonde.fr/blog/wp-content/plugins/pointelle-slider/js/jquery.cycle.js?ver=1.1
     status: (referer=-www.regardsurlemonde.fr/blog/)saved 32046 bytes e98fc1630e4a5268e15733ddd6280cdff3b09f6f
     info: [decodingLevel=0] found JavaScript
     error: undefined variable jQuery
     error: undefined variable $.browser
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var $.browser = 1;
          error: line:1: ....^
     suspicious:   I get no avast webshield alert now going to the main site.
Found to be malicious here: http://trafficlight.bitdefender.com/info?url=http://www.regardsurlemonde.fr/blog/

polonus

[rvtalawila]

I am having issues with my PPI site http://ppi-insuranceclaims.co.uk. This is only a recent thing. My Avast version is 6.0.1637 and fully updated.

This is ofcourse a big concern as I do not want to lose customers. I have run a check on http://sitecheck.sucuri.net/results/http://ppi-insuranceclaims.co.uk which shows no issues.

Can anyone help?

[Pondus]

I am having issues with my PPI site http://ppi-insuranceclaims.co.uk. This is only a recent thing. My Avast version is 6.0.1637 and fully updated.

This is ofcourse a big concern as I do not want to lose customers. I have run a check on http://sitecheck.sucuri.net/results/http://ppi-insuranceclaims.co.uk which shows no issues.

Can anyone help?

you should start your own topic   .......guess not

This page seems to be <suspicious>  1 suspicious inline script found.

Jotti
http://virusscan.jotti.org/en/scanresult/4c25f58446b1e85557c926d6c5cd61a969675dc0