Forums

Malicious code / pop ups in my blog (12 posts)

  1. chrisdigo
    Member
    Posted 6 years ago #

    Hello

    I have a problem with my wordpress blog.
    I've been looking at it but I cannot find out from where the problem is coming from.

    I have several pop-ups coming up when you access my blog. I didn't put any code for this so I'm thinking it's a malicious code that get inserted I don't know how.

    I know the pop-ups are NOT coming from my hosting provider.

    My blog adress is
    http://adproject.free.fr/wordpress/

    When you access it pop-ups will come up ! Warning !

    With Firefox, I did tools / page info and here is what I see:

    http://www.maj.com/gallery/chrisdigo/misc/popup.jpg

    I've tried to look at the source code, the sidebar template code, header and footer but I don't find anything.

    Can anybody help me on how can I remove this code and where is it coming from?

    Thank you.

  2. Les Bessant
    Moderator
    Posted 6 years ago #

    I don't get any popups from your site, and a page info doesn't show those links.

  3. Mark (podz)
    Support Maven
    Posted 6 years ago #

    No popups here either.
    Opera reports 103 images though which is a bit much.

  4. jaseone
    Member
    Posted 6 years ago #

    You include a lot of external Javascript in your site so it could be anyone of those, I did have Firefox block popups the first time but it won't give me the popups again to see what they are so it must be random advertising from one of the services you are using.

    Your front page is absolutely huge, you really should try to trim that down some, a lot of your posts really should use the more link. Plus you have way too much in your sidebar and in MSIE as you don't have your width's right the sidebar drops all the way down to the bottom of the page, which usually happens when you have something too wide in there.

    What are the popups you arte getting and does a Google reveal anything about the site?

  5. chrisdigo
    Member
    Posted 6 years ago #

    Hello

    Thanks guys for your fast response.

    Me I get a pop up on the opening. However if you do a page info right away, you will not see this:
    http://www.maj.com/gallery/chrisdigo/misc/popup.jpg

    I get this when I do a reload and then again page info !

    Jaseone -> thanks for your advise. Yeah I know my page doesn't appear right on MSIE. :o( I need to work on it.

    the popups I'm getting comme from

    a.as-eu.falkag.net
    red.as-eu.falkag.net

    here are some popups:
    http://www.maj.com/gallery/chrisdigo/misc/popup1.jpg
    http://www.maj.com/gallery/chrisdigo/misc/popup2.jpg
    http://www.maj.com/gallery/chrisdigo/misc/popup3.jpg

    What do you guys think? Thanks again.

  6. Mark (podz)
    Support Maven
    Posted 6 years ago #

    Go scan your machine ?

    Use adaware, spybot S&D as a minimum, and if you have some resident evil, clean it up.

  7. jaseone
    Member
    Posted 6 years ago #

    I haven't heard of anything that hijacks Firefox that way though and that is where the original problem was. My guess is either something random from the host or one of the external javascripts included on the page.

    chrisdigo,

    That front page is almost 1mb all up, that is way too big so you really should do some trimming here and there.

  8. jaseone
    Member
    Posted 6 years ago #

    Okay found it...

    Whatever you have in the block:

    <!-- Begin Nedstat Basic code -->

    Is randomly returning more Javascript that contains the code to open the popups, I suggest you use something else for your stats as Nedstat whoever they are don't seem to be a good choice if they are doing things like that.

  9. Mark (podz)
    Support Maven
    Posted 6 years ago #

  10. chrisdigo
    Member
    Posted 6 years ago #

    jaseone -> Thank you !! I removed the Nedstat code and the pop-ups are gone !! So yes it was indeed Webstats4U (former Nedstat) that was causing the problem.

    Podz -> Thanks for the link and the help !

    Well now that the pop-ups are gone I still have to do some clean up in my page as it seems it is too heavy (and to make it looks ok with msie).

    Again, thanks all for your help ! Very much appreciated. Regards.

  11. chrisdigo
    Member
    Posted 6 years ago #

    jaseone -> One question do. What did you do to find out ? ;o)

  12. jaseone
    Member
    Posted 6 years ago #

    I reloaded the page until it gave me the popup (that FF blocked and let me know about), then saved the complete page and searched the files using Textpad (all I have on my work PC that can do it, would prefer jEdit on Windows and TextMate on Mac) for falkag then backtracked through the results to see what was causing it.

Topic Closed

This topic has been closed to new replies.

About this Topic