Find and remove website viruses

Being involved in hosting and internet domains business I noticed that there are an increasing number of virused websites and also there is scarcely any free online virus scanner for websites.

So what I did was to create an online scanner based on Clam AntiVirus, a free Unix scanner.
Just add your website in the form available here and your site will be scanned in seconds.

If there was no virus found then its great. In the unfortunate case a virus was found then look below for a list of common trojans/exploits/viruses and the instructions on how to get rid of them.
If your virus/trojan/etc. is not listed here then feel free to leave a message here or contact me and I’ll try to help you.

Virus HTML.Iframe-32
Edit the site source and search for a line like this
<iframe src=”SOME_WEB_ADDRESS” width=2 height=4 style=”visibility: hidden”></iframe>
and remove it.

Virus JS.Redirect-2
Edit the source and you should see at the very begging of the site a line starting with
<script>eval( unescape( “%69%66
Make sure you remove it.

Virus Exploit.HTML.IFrame-6
At the very beginning of the page you’ll notice a script command starting like this:
<script>document.write(unescape(’%u003
Remove it till you find a <!DOCTYPE HTML PUBLIC definition or <html>

Virus Trojan.Downloader.JS.Psyme-13
At the very end of the HTML page, after the </html> tag you should see something like
<script>function v47e7289bd5281
Remove it

Virus JS.Agent-4
In <body> part look for a function definition like
<script language=’JavaScript’>function ndfc()
and remove it.

Virus HTML.JScript-1
Just after the <body> tag you should see inside a <span> tag a long JS function definition.
Remove it and that should be all.

5 Responses to “Find and remove website viruses”


  1. 1 Alexandru

    Hi, what whould be the cause of the infection? online exploit, file or db injection, or simply a ftp connection from an infected computer? thx in advance

  2. 2 admin

    To my knowledge it could be either way.

    If you have a site with buggy scripts it can be web-hacked and virused.

    If the scripts are well written but you computer is infected then the upon FTP connection to your site it could get infected.

  3. 3 Mumnravanen

    Thank you looking for details. It helped me in my assignment

  4. 4 Article Submission

    Hi, just wanted you to know I have saved your blog to my bookmarks because of your great blog layout (LOL). But honestly, I believe your blog has one of the cleanest design I’ve came across. It honestly helps make reading your blog a lot easier.

  5. 5 Rob Rockenbach

    Thank you for the intelligent critique. Me and my neighbour were just setting up to do some research about this. I am very glad to see such great information being shared freely out there.

Leave a Reply