Junk text inserted at bottom of pages with porn links | WordPress.org

gregcohen
(@gregcohen)

11 years, 11 months ago

Hi gang, I’m sorry if this is painfully obvious or has been asked elsewhere.

I have one user who sees junk text inserted at the bottom of some pages at runner.org. Here’s what he sent me: https://img.skitch.com/20120525-x5u6ack1jcw95849qbhbd7jpux.jpg

Here’s the page he’s looking at: http://www.runner.org/sybil-2012-race-report/

I can’t recreate it on my end and imagine he is suffering from some sort of man in the middle code insertion (if that’s even a thing), but don’t know what to tell him to do or what it’s happening.

Thank you folks for any help.

Viewing 8 replies - 1 through 8 (of 8 total)

Chip Bennett
(@chipbennett)

11 years, 11 months ago

What Theme are you using, and where did you get it?

Paweł Knapek
(@adpawl)

11 years, 11 months ago

Your site probably is infected.
Check footer.php file.

Read:
http://codex.wordpress.org/FAQ_My_site_was_hacked
http://wordpress.org/support/topic/268083#post-1065779
http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
http://ottopress.com/2009/hacked-wordpress-backdoors/
http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

online scanner:
http://sitecheck.sucuri.net/scanner/
…others: http://www.malwarehelp.org/freeware-open-source-commercial-website-security-tools-services-downloads.html

http://codex.wordpress.org/Hardening_WordPress

Thread Starter gregcohen
(@gregcohen)

11 years, 11 months ago

Hey Chip, I’m using Atahualpa 3.4.9 which I downloaded from bytesforall. The site has been up for a couple of years. Thank you for your help!

Thread Starter gregcohen
(@gregcohen)

11 years, 11 months ago

Thanks adpawl, do you mind taking a quick look at this: http://pastebin.com/TC0BHaix

It looks fine to me, but I’m a total hack!

Thanks man.

Chip Bennett
(@chipbennett)

11 years, 11 months ago

Ask your user to check your site using a different computer, and report whether he still sees the links or not.
Paweł Knapek
(@adpawl)

11 years, 11 months ago
it’s placed between

and
```
</td>

```
hmmm… check:
if ($bfa_ata == "") include_once (TEMPLATEPATH . '/functions/bfa_get_options.php'); ?>
…or is in another file.

Try search by files modification time.

Anyway, you still have to check all and find and remove the backdoor.
Thread Starter gregcohen
(@gregcohen)

11 years, 11 months ago

Adpawl, is there something you see in there that’s bad? here’s bfa_get_options.php, all looks legit, no?

http://pastebin.com/b36RtfsV

Chip, I did ask the user to try from other computer, he tried from his wife’s mac, which I imagine is on the same network. He’s asking his daughter to try from her house.

I see nothing from here — and I’ve tried a bunch of machines and different networks.

Thanks all, I really appreciate it!

Paweł Knapek
(@adpawl)

11 years, 11 months ago

Hard to say … nothing special.
Try get page content via Google Webmaster Tools and check would the answer still contains this code.

Surely you are using a fairly old version of the template, better upgrade it to latest version.

Viewing 8 replies - 1 through 8 (of 8 total)

The topic ‘Junk text inserted at bottom of pages with porn links’ is closed to new replies.

In: Fixing WordPress
8 replies
3 participants
Last reply from: Paweł Knapek
Last activity: 11 years, 11 months ago
Status: not resolved

Topics

Topics with no replies

Non-support topics

Resolved topics

Unresolved topics

All topics