Can't find JS: Redirector-NS[TRJ]

Viruses and worms
1

My Website continues to get an avast warning when I go to certain admin or login pages.

My site URL is hxtp://www.pictureplanit.com

Both my hosting company and I have cleaned all the malware and infected files and quarantined them, but I am still getting this avast warning.

2

can you attach a screen shot of the avast warning ?

This page seems to be 1 suspicious inline script found.
http://www.UnmaskParasites.com/security-report/?page=www.pictureplanit.com

3

What is avast! alerting?

Can you attach a screenshot of the alert?

If not, if the “More Info” option is available to you, click on it. This should bring you to an online avast! page. Copy the url and paste it in your next reply.

4

I will try and attach a screen shot. I posted before I was finished writing…here is some additional info as well.

This is what the warning looks like:

js:Redirector-NS [Trj]

Infection: URL; MAL

and it tries (but is blocked by avast) to re direct to this website
hxxp://thegrindcast.osa.pl/showtread.php?t=51282440

The page on my site that this warning references is hxxp://www.pictureplanit.com/admin/index.php

Any help would be appreciated…thanks!

5

Sorry, but I am not able to access the admin.php, as it redirects me to login.php.

Also confirmed by Wepawet.
http://wepawet.iseclab.org/view.php?hash=44121e49f38e28a7d2faccad62048ea6&t=1329769413&type=js

This wXw.pictureplanit.com/admin/login.php doesn’t seem to have a javascript redirect on the main site or on any javascripts it refers to.

The redirected site results, 4/19:
https://www.virustotal.com/url/9a6fda638d4362b87c0f31568b45b33b7cf888ab61f36a2b397ae7627f4e568e/analysis/1329769494/

6

There is also a wrong position for the pageTracker code, should not be somewhere outside HTML or only in the footer,

polonus