WordPress.org

1. trueseeker
   Member
   Posted 2 years ago #

   Hello,

   Can anyone please explain what does this URL mean:

   norton-kaspersky . ru/new/traff.php?
   [moderated - link broken]
   Every time I browse my blog website and move between pages, even in the Admin section, I get a warning in IE7 that says:

   "This website wants to run the following add-on: Microsoft Outlook from Microsoft Corporation...." as I didn't allow the add-on, I could see the above URL attempting to load up. The worse that happened whilst in IE6 in another computer, was that the add-on tried to run and the webpage froze until the site disappeared and the computer starting behaving strangely so I had to switch it off.

   I have only two plugins activated, the database backup and the keyword/metatags.

   I would be grateful for any help on this.

   Thank you

2. whooami
   Member
   Posted 2 years ago #

   where is your blog? and why are you asking people to click a link to a .ru site without explaining in detail whats there.

   Its a fricken malicious script, and if its being loaded when your _unidentified_ blog is brought up in a browser than its been added to your site via something that was left with the wrong permissions.

   for those that like doing things the SAFE way, here the cache of that link:

   http://72.14.203.104/search?q=cache:x2zs130ABE0J:www.norton-kaspersky.ru/new/traff.php+www.norton-kaspersky.ru/new/traff.php&hl=en&gl=us&ct=clnk&cd=2

   view the source if your curious (or just turn off javascript).

   I dont click ANY .ru links casually and unceremoniously posted on ANY forums.

3. trueseeker
   Member
   Posted 2 years ago #

   Hello Whooami,

   Thank you for your reply. When I put the link I didn't know it was a malicious URL hence my post.

   Thank you for bringing it to mine and everyone elses attention. I don't know how it got there but if it is a case of bad permissions I will have to re-install the blog and make sure all permissions are set right.

4. whooami
   Member
   Posted 2 years ago #

   you DONT have to reinstall, you just have the find the iframe its loading in .. start with footer.php in your theme files.

   After youve found it, chmod your theme files to 644, i'll bet you 100.00 bucks theyre chmod 666 or 777 right now.

   You will also need to chmod your theme directory BACK to 775.

   ---

   This is just one more damn post that reinforces what Ive been saying for months now about permissions.

5. trueseeker
   Member
   Posted 2 years ago #

   Thank you whooami, your reply has been very helpful and on time, before I proceeded to delete and reinstall.

   I did find the iframe in the index.php and other root files and that's before I go to the theme files! You are right about the permissions settings (bet well placed!).

   Thanks for your help.

6. sbgwebdesigns
   Member
   Posted 2 years ago #

   well I thought I posted must went else wheres.
   But I was told to get the IP addy and block
   norton-kaspersky once all was cleaned up..and
   permissions changed. It is on a traffic exchange
   program. Have to close down to do maintence do to
   changing permissions etc. So can anyone tell me
   about the how to on this? Thanks

Topic Closed

This topic has been closed to new replies.