Sign up ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I get an ad pop up that should not be on the site. It has only appeared once.

The HTML code for the pop up window that appeared:

Here is the full HTML pastie:

It is a rather new adware/malware software.

I found other people having the same problem:

And last I found this forum where the Admin says it was a vulnarbility in the code:

But he does not mention which vulnerability.

share|improve this question
What CMS (Content Management System) or software are you running on your website? What version is it and is it the latest one? Also, does it happen on different computers or just yours? –  ub3rst4r Jan 13 '13 at 3:59
SiteCake v. 1.0.14 . It have happen to different computers that have visted the site. –  Rails beginner Jan 13 '13 at 4:20

2 Answers 2

I doubt that @Joe's answer will work, as the injection script is likely encrypted or at least obfuscated.

It appears that SiteCake is written in PHP, so do a search for base64_decode, str_rot13 and gzdeflate as these are often used to disguise exploit code.

It is by no means certain that components using these commands are definitely malware, but the strong implication is that they probably are. If there is any of this unpleasantness present, try to disable any plugins that include them, but be aware that they might have injected bad stuff into otherwise innocent files.

share|improve this answer

Search through the code of the component of the person who made it and look specifically for the URL of that pastie thing.

It could either be that it really is a vulnerability or that the admin has purposely added it.

share|improve this answer
See my answer for explanation of my downvote. –  DaveP Jun 16 '13 at 11:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.