Hoorkeet

Should you point me exactly to the files infected?

 /home1/hoorkeet/public_html/geonotes/moo/accordion.html /home1/hoorkeet/public_html/geonotes/moo/native.html /home1/hoorkeet/public_html/geonotes/moo/Request.JSON.html /home1/hoorkeet/public_html/geonotes/moo/Sortables.html 

Yes! Really, found it there and removed successfully. Should be now clean. Thanks!

Hi!

Should you point me exactly to the files infected? I've tested the files, but had not found anything malicious.. Maybe it is this piece of code?

<script src="http://tools.spylog.ru/counter_cv.js" id="spylog_code" type="text/javascript" counter="706543" part="" track_links="ext" page_level="1">

And this is just a counter from spylog.ru - let me know, if this really need to be removed I'll remove.

a. your HelioHost username: hoorkeet

b. the server your account is on: Stevie?

c. your HelioHost main domain: afisha.te.ua

Please explain what is wrong with it, thanks.

a. your HelioHost username - Hoorkeet

b. the server your account is on - stevie

c. your HelioHost main domain - afisha.te.ua

Ok, thanks.

a. your HelioHost username - Hoorkeet

b. the server your account is on - stevie

c. your HelioHost main domain - afisha.te.ua