Site showing malware to a percentage of users, how can I find it?

Discussion in 'Security' started by blogofhilarity, Nov 13, 2008.

  1. #1
    Hi all,

    I'm at a complete loss as to what to do. I run a Wordpress blog but something is running that's redirecting my site (for a small percentage of users) to a Malware site (one of those fake anti-spyware ones). The Wordpress exploit plugin doesn't show anything on the files and I've tried turning off my ad networks but the problem continues. Can anyone help me figure this out?

    The site in question is Blogofhilarity.com if that helps...

    Thanks,
    Chris
     
    blogofhilarity, Nov 13, 2008 IP
  2. UseShots

    UseShots Peon

    Messages:
    244
    Likes Received:
    16
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Hi,

    You should check your .htaccess file. There might be conditional redirects.

    If it is clean, check all WordPress (including your theme) .php files for inclusion of string "redirect". Then check if the redirects are legitimate.
     
    UseShots, Nov 14, 2008 IP
  3. WeWatch

    WeWatch Active Member

    Messages:
    75
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    50
    #3
    Maybe it's (the redirect code) checking user agents and only redirecting based on what browser or version of browser is visiting.

    According to your blog, you located the problem with one of your adservers.

    I guess this case is closed.
     
    WeWatch, Nov 16, 2008 IP