JS:Redirector-CV [Trj] problem on every site on my webserver

Viruses and worms
1

Hi folks, can you help me?
I have a little web server with few web sites and 3 days ago many users started contacting me about trojans on sites which are on my server. In all cases is the trojan detected only with Avast! antivirus, other antivirus softwares says the site is clean. For this case a installed a clean Windows XP and on virtual PC and the latest version of Avast!. The users were right.

Every web site (domain) have own different FTP and database accounts. The problem is on all domains, and randomly is infected an image, a script or the page. I checked the pages, they are clean, codes are clean, I don’t now where is the problem. Once is page infected and blocked, after refresh is alert on another part of page and it’s loaded. I can’t explain it, the infected files are changing randomly? No, it’s bulls… Please help with this problem. Thanks.

The websites for example:

http://taxi-schwechat.sk
http://korkep.sk
http://allspark.info
http://e1.sk
http://beszoltam.hu
http://figuravin.sk

P.s.: Sometimes for a few hours is everything ok. For example, at morning users wrote me, the problem is solved, and at evening they call me: the virus (trojan) is back.

2

I entered to these sites and found no problem, no alert from avast!.

3

Yes, actually is everything ok, but 3 hours ago…
But I have an idea. It doesn’t make sense, but two hours ago I restarted the Apache (2.2.x). Can it be the reason why the pages are actually without trojan warnings? The virus database is the same 101107-1.

4

The problem is here again. Only for few minutes, but it’s frustrating. Actually is friday 22:18 (10:18 PM) here and clients calling me. I checked the pages from virtual OS with installed Avast, and I get alerts for all domains, but after 2 minutes and few refreshes, they are gone. What is wrong, where is the problem? I don’t undersand that, please help.

P.s.: No changes on server.

5

Could you post an example, if it should happen again…?!
asyn

6

Of course.

7

I have seen something similar - have just taken ownsership of this site and find that avast reports the redirector-CV trojan occasionally for various files - gif’s and ico’s so far. site is www(dot)xiva(dot)com
OS - XP Pro SP3
Browser- Chrome/IE8
Avast:
virus def 101113-1
program vn 5.0.677

8

In this moment same problem on my sites.

9

I got no alert.

10

Actually no alert on my PC. As I wrote, it’s totally random - 2 days ok, after that 1 hour warnings, and for 3 days is everything ok again.