Webpage Injections [RESOLVED - hopefully]

[Haze]

HI All,

A personal friend got in touch today to say that his website has malware associated with it. He now takes charge of editing his ite, and all I could find that looked odd was a link to

http:// bs. serving - tracking . com /? campaignid = 135324812&type=tracking

. I am Googling info on it at the oment, but just wanted to mention it.

[Dom]

Was it a Wordpress site per chance? I've had the same thing happen to me (although with a different link) and it turned out to be a compromised Wordpress theme. I had to completely uninstall the theme and use a new one.

[rutty]

What Dom says - happened to me too (my own stupid fault for downloading from a free themes site).

Look in the theme for some BASE64 code that's obfuscating something malicious. My links to malware popped in and out and it was VERY hard to pin down what the hell was going on

[sarahA]

Most injected malware these days is via base64 encoded PHP or javascript. Sometimes it's also set to only show you once and then if you return you don't see it, making it harder to pinpoint.

[Haze]

Wasn't a WP site, seems his site was the only one affected on the server, I am told. There were 6 or 7 files affected. Just had to edit and remove the code, and generate a new password for him.

[Dom]

I removed the offending code from my Wordpress theme when I found it (and yep, it was some BASE64-encoded nasty that was doing it) but I found that even then, whoever it was managed to put the code back in afterwards.

It might not be a WP site, and might only affect one of your sites, but I'd be a little concerned about how they did it in the first place, or else simply taking the offending code out might not stop them from being able to put it back again. With me, I had to completely remove the theme, and the database amendments, and use something else.

Just some food for thought.

[sarahA]

If it's on an 'open' shared server (ie. not running PHPsuExec), then they can get in via any site on the server and edit your files. So your site could be as secure as possible, but it's relying on your server neighbours that's the frustrating part.