CK020

Thank you itman, I have identified the infection in the functions.php and cleaned it.

Ah I understand, but I read in other treads that you suggested to search for certain (unique) parts of the code... That's why I was asking. Although I think I have found and deleted the script.

Thank you for the information, but I can't seem to find any file containing this script. Can you tell me where to look?

Hello all, By a customer I was notified that our webshop (aalvink.nl) was infected by JS/Spy.Banker.MP. When I run sitecheck.sucuri.net and virustotal.com I can't find any infection. With the help of the forum I searched for 'c2V0VGltZW91dChmdW5jdG' which helped me find 2 files with a line of code with this in it, so I deleted them. Because I can't replicate the warning, I am not sure if my site is clean now... Can you please give me some assistance? Much appreciated.