Sign up ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I get an ad pop up that should not be on the site. It has only appeared once.

The HTML code for the pop up window that appeared:

Here is the full HTML pastie:

It is a rather new adware/malware software.

I found other people having the same problem:

And last I found this forum where the Admin says it was a vulnarbility in the code:

But he does not mention which vulnerability.

share|improve this question
What CMS (Content Management System) or software are you running on your website? What version is it and is it the latest one? Also, does it happen on different computers or just yours? – ub3rst4r Jan 13 '13 at 3:59
SiteCake v. 1.0.14 . It have happen to different computers that have visted the site. – Rails beginner Jan 13 '13 at 4:20

3 Answers 3

I doubt that @Joe's answer will work, as the injection script is likely encrypted or at least obfuscated.

It appears that SiteCake is written in PHP, so do a search for base64_decode, str_rot13 and gzdeflate as these are often used to disguise exploit code.

It is by no means certain that components using these commands are definitely malware, but the strong implication is that they probably are. If there is any of this unpleasantness present, try to disable any plugins that include them, but be aware that they might have injected bad stuff into otherwise innocent files.

share|improve this answer

All this started a week ago. WikiTime Ads infected my system and mainly the browser. I observed that it made several unwanted modifications in my computer especially in my web browser. While Internet surfing it always redirected me to the commercial sites. It also changed some of the browser settings like replaced the current homepage and default search engine of the browser. First time I was facing this type of problem. My antivirus tool was not that much strong to delete this virus infection. Then, I used Automatic Removal Tool through that helped me to remove all the virus infections from the system effectively.

share|improve this answer
What are you specifically suggesting? What steps should be taken to answer the question? – Andrew Lott Oct 11 at 12:22

Search through the code of the component of the person who made it and look specifically for the URL of that pastie thing.

It could either be that it really is a vulnerability or that the admin has purposely added it.

share|improve this answer
See my answer for explanation of my downvote. – DaveP Jun 16 '13 at 11:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.