Hacked

Are you able to post server logs from the time the hack happened?

Yes i can, i think it happen yesterday afternoon.

Error_log
www.jselteknik.dk/php/error_log.zip
Access.log
www.jselteknik.dk/php/access.zip

And what do you see on your web site? What is actually wrong?

i see this:
www.jselteknik.dk/php/scs.png

If you wan't to i can give you access via ftp

I'm not good at Danish, but I think your site tries to load an iframe with some dirty content in it. Any chance we could see the site? I'm just getting a HTTP 403 Forbidden here.

Which pages gives you this error, by the way?

Boot sites up and running with trojan on

Site: www.jselteknik.dk and www.combatclan.dk

Page index.php and login.php are infected

I think it's your computer that's causing issues. I'm not getting anything. Second link does have two iframe, perhaps that's making Avast suspicious. Other than that, I've no reason to think it's not a client-side issue, unless others experience the same issues.

Perhaps you are right but i have this isue on 2 PC's, one with Avast and one with Eset both saying the same.

I have now manuel via ftp removed script string in index.php and login.php on jselteknik.dk and it seems ok right now.

Try replacing all files with those from the the full download package, see if that solves something. If not, it may still be an infusion or a server issue.

Also - DO NOT use Internet Explorer, especially version 6.
It's VERY BIG door for trojans, viruses etc etc etc

I've experienced this before. Avira detected trojan, Avast detected too. Kaspersky totally block my site. LOL. what i did is i upgrade my site to php fusion 7. poof! done.

I think this may be related to a bug in your browser, as I have gotten no reports that this happens in a browser other than Internet Explorer.

Hmmm maybe your right, i have had no probs with www.jselteknik.dk since i manuel removed script via ftp.

Wath i don't understand is that i got warned on pc one with avast, XP pro and old ver 6 IE and on pc 2 with Eset, win 7 pro 64 bit and IE 8.

Futher more i can't understand how files are ended up on my to sites, one hosted by one.com and second by scannet.dk.

When i'm on sites via ftp, totalcommander, then scripst was / are lying there in index.php ... on my 2 sites so someone must have put them there or am i completly wrong?

"someone" might be a trojan/backdoor (from IE...)

Note it says

If I had to guess I'd say it's a browser-hijack that's somehow either hidden in or related to an IFrame, have you tried your site in Firefox?

Windoze sucks, but that's besides the point. You use a lame browser therefore your browsing experience is going to be LAME

Well if you are not going to upgrade to the latest scripts what do you expect?

Update:
one site closed for god, not in use anymore by CCDK.
Other site works fine and have done in a couple of weeks.
I uploaded new files, changed mysql, ftp and superadmin password and it seems as it has helped.