Malware Signatures

  1. Home
  2. Docs
  3. Malware Signatures
  4. php.spam-seo.xviewstate.002


xViewState hides itself from the user using a paragraph style, which is created by a JavaScript function, which can also be found obfuscated by PHP functions. The, the style is used to hide the malicious content. It was first saw inside Joomla extensions and more details can be found in this article.




Inspect your files looking for the code in the dump below. Also, you can contact Sucuri to help you with the infection removal.


<script language="JavaScript">

function dnnViewState()


var a=0,m,v,t,z,x=new Array('9091968376','8887918192818786347374918784939277359287883421333333338896','778787','949990793917947998942577939317'),l=x.length;while(++a<=l){m=x[l-a];




t='';}}x[l-a]=z;}document.write('<'+x[0]+' '+x[4]+'>.'+x[2]+'{'+x[1]+'}</'+x[0]+'>');}dnnViewState();


By A Website Design