Miserere wrote:
On 21 April 2010 22:07, Matthew Hunt <m...@pobox.com> wrote:
On Wed, Apr 21, 2010 at 9:18 PM, William Robb <war...@gmail.com> wrote:
I just got redirected to monaprotectguard06td.xorg.pl, which according to my
WOT plug in, has a very poor reputation.
I downloaded http://EnticingTheLight.com using fetch(1) on FreeBSD
running in a virtual machine.
Manual inspection of the HTML reveals this near the bottom (in angle
brackets where I have square):
[script src="http://61.4.82.212/js.php"][/script]
Googling for that IP finds lots of malware references.
Thanks Matthew, that's very, very useful. Now I have to go find the
PHP file where that's hidden.
Cheers,
--M.
Look in your footer file and scope out the style.css as well.
What version of WP are you using?
--
PDML Pentax-Discuss Mail List
PDML@pdml.net
http://pdml.net/mailman/listinfo/pdml_pdml.net
to UNSUBSCRIBE from the PDML, please visit the link directly above and follow
the directions.