How to find a virus on a website?

Question

Malware

www.google.com/safebrowsing/diagnostic?site=www.co...
The nonsense is that - what Google swears at - this file has not been on the site for 3 days - www.cottage.ru/js/slide.js Code injection 04/25/13
And even the mention of it was removed…
URL examples with malicious code
Load this spreadsheet
Request for review
Show Lines: 25 1-25 of 35
URL Type Last checked
cottage.ru/ —
04/26/13 www.cottage.ru / —
04/26/13 www.cottage.ru/js/slide.js Code injection 04/25/13
www.cottage.ru/objects/village/moscow/borovskoe/?p=33 —
04/24/13 www.cottage.ru/objects /village/moscow/borovskoe/ - 04/24/13
www.cottage.ru/objects/cottage/moscow/ostashkovsko... — 23.04.13
www.cottage.ru/objects/site/moscow/mozhayskoe/?p=12 — 23.04.13
www.cottage.ru/objects/ cottage/moscow/ostashkovskoe... — 23.04.13
www.cottage.ru/objects/site/moscow/ostashkovskoe/?p=1 — 23.04.13
www.cottage.ru/objects/cottage/moscow/pyatnitskoe/?p =4 —
04/23/13 www.cottage.ru/objects/village/moscow/kievskoe/?p=1 —
04/23/13 Ready to pay for those who find a hole.
Thank you!

Answer 1

At least the site has sql-injection www.cottage.ru/persons/view.htm?id=1 '+union+select+0,0,0,0,0,0,0,0,0,version( ),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
we get the login-password or its hash from the database, then from /robots.txt we find out the path to the admin panel www.cottage.ru/adm/ - profit.

Answer 2

Perhaps there was a backdoor on the site and through it the attacker edits / uploads files. Try running this script on the site - www.revisium.com/ai/ . It will help to find suspicious lines in the code, shells, etc.

Answer 3

safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fwww.cottage.ru%2Fjs%2Fslide.js&client=googlechrome&hl=ru \

Has this site hosted malware?
No. This site has not hosted malware in the last 90 days.

No wonder you can't find it.

If you are the owner of this website, you can request an analysis of your site using Google Webmaster Tools. For more information about the analysis process, see the Google Webmaster Tools Help Center.

Tried?

what Google swears at - this file has not been on the site for 3 days - www.cottage.ru/js/slide.js

I don't see Google swearing at this file now i.imgur.com/FTlvacd.png Do you have anything to do with the other domains listed? Are you on shared hosting or wds?

Answer 4

run all the pictures through the antivirus.

Answer 5

opened the site. Google is silent. Kaspersky too.
Looked through. Flight is normal.