Advertising hacker within the code

Discussion in 'WordPress' started by RameshNL, Jun 20, 2012.

  1. #1
    Hi all. I have a site created with Wordpress and sometimes when I open it, a popup shows up to some casino ad, but I haven't put it in there. Is there some plugin to track that code?
     
    RameshNL, Jun 20, 2012 IP
  2. Imposter

    Imposter Peon

    Messages:
    169
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    0
    #2
    If you did not download a theme from the official directory there is a high probability that the popups are opening because of some code in its files.
     
    Imposter, Jun 20, 2012 IP
  3. RameshNL

    RameshNL Peon

    Messages:
    42
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    I use a theme from Socrates. They are usually well protected right or am I totally mistaken here?
     
    RameshNL, Jun 20, 2012 IP
  4. Imposter

    Imposter Peon

    Messages:
    169
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    0
    #4
    It is also possible that you have installed some nasty plugin that does this dirty job.
     
    Imposter, Jun 20, 2012 IP
  5. frednjkin

    frednjkin Active Member

    Messages:
    161
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    55
    #5
    Yes this might an issue with a plugin, wud suggest you to check your scripts/plugins one-by-one & hope you find the troublemaker & remove it :)
     
    frednjkin, Jun 20, 2012 IP
  6. RameshNL

    RameshNL Peon

    Messages:
    42
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #6
    Ah, that is going to be a heck of a searching job, thanks for the info.
     
    RameshNL, Jun 20, 2012 IP
  7. cons1t

    cons1t Peon

    Messages:
    43
    Likes Received:
    0
    Best Answers:
    1
    Trophy Points:
    0
    #7
    Some tips that might help.

    #1 Download Notepad++ and use find in files function to search in all files in a directory.
    #2 Search *.php or whatever and copy all files to single folder.
    #3 Search that folder with notpad++ for...

    Check the source of the advert for any string that might ID it, like domain names or IP address that the add are being served from, a title tag or some pattern that repeats in all the popups. Maybe they all use they same style sheet or something.

    One famous pop under always has the script <script type="text/javascript" src="http://static.awempire.com/js/jquery-1.4.2.min.js"></script> in it for example so you might search that in whole or just static.awempire.com.
     
    cons1t, Jun 20, 2012 IP
  8. RameshNL

    RameshNL Peon

    Messages:
    42
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #8
    Great advice. I will check it out. Thanks for the info.
     
    RameshNL, Jun 21, 2012 IP
  9. Sensei.Design

    Sensei.Design Prominent Member

    Messages:
    3,847
    Likes Received:
    162
    Best Answers:
    0
    Trophy Points:
    310
    Digital Goods:
    1
    #9
    Well just a short question as I couldn't find the answer here in the thread. Are you hosting your blog on a free or paid hosting plan?
     
    Sensei.Design, Jun 21, 2012 IP
  10. RameshNL

    RameshNL Peon

    Messages:
    42
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #10
    A paid hosting plan.
     
    RameshNL, Jun 21, 2012 IP
  11. Sensei.Design

    Sensei.Design Prominent Member

    Messages:
    3,847
    Likes Received:
    162
    Best Answers:
    0
    Trophy Points:
    310
    Digital Goods:
    1
    #11
    ok, as sometimes free hosting companies tend to ad ads to their customers webspace to make some money.

    Did you find a script included in the head or footer section of your theme? You can also use FireBug to find out where the code for the Pop-Up is included in the site.
     
    Sensei.Design, Jun 21, 2012 IP
  12. RameshNL

    RameshNL Peon

    Messages:
    42
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #12
    Yeah, that is what you see a lot with free hosting...No, the ad pops up when the site is as good as totally loaded, so the header is not where it is. It could be in the footer, but I haven't found anything in there.I will try out this FireBug. Thanks.
     
    RameshNL, Jun 21, 2012 IP
  13. cons1t

    cons1t Peon

    Messages:
    43
    Likes Received:
    0
    Best Answers:
    1
    Trophy Points:
    0
    #13
    Another thought today, the ad's might be sourcing information from the database to prevent file scans, you should search your database for anything suspicious.
     
    cons1t, Jun 21, 2012 IP