Is my company's website truly infected? HEUR:Trojan.Script.Balada.gen

[harlan4096]

I've also just re-sent to K. analysts, waiting a verdict.

[harlan4096]

It seems the site is infected, K. analysts message:

 

Quote

 

Hello,

This is not a false alarm. This site is infected.

Here is the malicious code:

<script id="sgpb-custom-script-363">jQuery(document).ready(function()   ............   KTt9"));};});});</script>

 

If you are a webmaster, please remove the above code from the page. Also we strongly recommend that you change passwords to all services that can be used to modify website contents because they may have been stolen.

 

Best regards, Malware Analyst
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com https://securelist.com
https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names

 

 

[Loffe]

hi my site     https : //ideaskl.com     also effected with this HEUR:Trojan.Script.Balada.gen. can help?

Edited October 3 by Berny

[Berny]

@Loffe 

Your URL has been submitted to Kaspersky Virus Lab , the verdict will be provided when available.

@Loffe

↓ From Kaspersky Virus Lab ↓

Quote

" Hello,

This is not a false alarm. This site is infected.
Here is the malicious code:
<script>var _0x3ec646   ..........   return _0x48d3();}</script>
If you are a webmaster, please remove the above code from the page. Also we strongly recommend that you change passwords to all services that can be used to modify website contents because they may have been stolen.

Best regards, Xxxxxxxxxxx , Malware Analyst
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 "