Possible hacker intrusion on my site

the javascript loads this page:

http://211.152.51.87/beian.htm

Speak Chinese? I dont.

You havent provided enough info for anyone to “help” you beyond that. In other words, if someone tried to use an include to load that, etc..

so thats that, there you go.

I tried searching this “http://218.5.77.71/beian.js” in google. It is definitely dangerous.

I think you may have to clean install your wordpress.

You can safely back up your post, pages and comments. Those are harmless.

Once you get the xml backup file, search for “http://218.5.77.71/beian.js”

MeneL001, BEFORE you start freaking out and taking advice from ppl, especially ppl that have NO post history, you need to determine WHY the link showed up in your stats.

To do so, you need to NOT rely on some third party stats site, and instead, look at your server logs. If you have cpanal available theyre accessible from there.

Its possible, and very likely that it was a simple attempt at an include attack — and thats NOT necessarily something that requires you to reinstall, backup, yadda yadda yadda.

In other words, calm down. Get your server logs. and if you need help figuring them out – send them to me @ whoo AT ( YOU NEED TO REMOVE THIS ) village-idiot.org

My guess is that that javascript is probably meant to be some kind of advert. After all, it is designed to open a new browser window, which itself links to a load of other places (none of which I could open at this time, just dead links.)

Possibly mallicious, but not particuarly harmful in and of itself, unless there is more to it.

IcelandDream,

Get a little perspective. On the surface, neither the js OR the page it opens is malicious.

Futhermore, we dont even know the context in which it showed up in this individuals logs. It may have simply been a referer, in which case, it nothing more than spam.

Your metaphor regarding someone breaking into your house is way off base, since so far, there is no evidence of any break in.

Furthermore, NO-ONE said it was NOT malicious, until me just NOW – and it isnt. Whats been recommended is looking at the Apache logs. The best advice was already given – so there’s no sense in flaming an uneeded fire.