I’m deleting out the iframe, brackets, , http : // , etc…

Hopefully it will appear here, so other people maybe able to identify the same / similar virus code they may be experiencing.

Paul

Came across your post when googling “GoDaddy Hosting Virus”

To keep this as brief as possible, we had major issues with over a dozen GoDaddy Shared Hosting accounts going back to April 2010, and since it’s now April 2011, and same crap different day is happening again.

Lot’s of time and money was lost last year, and all GoDaddy did was pass the buck, at first didn’t even admit there was a problem, then did – sorta. We still had to painstakingly fix all of this over 500 websites.

Tried your script in this post, but it doesn’t seem to be detecting this new “virus strain”.

Here is the bs code that is implanted on hundreds of index files on the bottom of each page after the “body” tag:

These sites do not have WordPress, but the same GoDaddy Shared Linux hosting accounts may have some WordPress installs on them.

The index pages on these landing pages do have an index.php extention.

Since we are not super techie, and GoDaddy is no help, even though we have multiple VIP accounts and thousands of domains with them too, need a permanent solution to not have these hosting issues again.

I’m sure more readers will be visiting your same post over the upcoming days, as it was on first page of Google for this problem, and I know there are more people having same issue again.

Any suggestions are greatly appreciated.

Thanks!

Paul

I’ve updated the script with some new options thanks to @peter’s input and version from his site.

Good luck to everyone who needs this. I need to write a follow up post about cleaning up your sites as well. Stay tuned.

I noticed my sites were infected this morning, tried to run godaddy’s update…didnt fix the problem completely.

So I stumbled across your post through google. You should send this to them. I had 13,000 infected files when I ran your php script. It managed to fix all of them.

Again, thank you.

I gave due credit..

Hope you don’t mind the changes.

Peter

For those of you with the original GoDaddy version of the hack, this page is still accurate. Look for a follow up post soon with a new script and more details.

Thanks.

The big question is of course: how does the malware code get into the PHP files? It seems (http://smackdown.blogsblogsblogs.com/2010/05/13/hosting-with-godaddy-might-want-to-rethink-that-decision/) a PHP file is uploaded to the site that executes, infests and then deletes itself.

HOWEVER, the main question remaining is HOW files can be dropped? How do they get in there? My passwords are pretty secure. I only use SFTP, have only one admin account, etc.. and and change my passwords after every hack. all in vain it seems…

peter