Help! Site hacked. Malware code viewable in source, but how do

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

Home All Forums

1
2
3
4
5

Home

Our Community

General Discuss...

Help! Site hacked. Malware code viewable in source, but how do I find it?

7/24/2009 12:10 PM

Web Architect

Joined: 5/11/2009

Posts: 4

Help! Site hacked. Malware code viewable in source, but how do I find it?

www.gscgymcheer.com (also the alias gymnasticssportcenter.com). Home page and http://www.gymnasticssportcenter.com/ContactUs/tabid/59/Default.aspx. It seems the code starts after <body id=...> tag with a <script> tag. I don't want to post the code here, so take a look if you think you can be helpful.

I am not a programmer, I'm just tring to figure this out while our programmer is on vacation.

Can anyone tell me what file this code is in?

Thank you in advance!

7/24/2009 12:47 PM

Tomasz Modelski

IT.tmod.pl
Joined: 7/9/2004

Posts: 26

Re: Help! Site hacked. Malware code viewable in source, but how do I find it?

Malware code can be in default.aspx and other *.aspx pages, Also in JavaScript files.
I've malware in those location when my DNN site was hacked. http://it.tmod.pl/Blog/EntryId/155/My-website-has-been-hacked.aspx
Many files were infected.

If you are not programmer, my solution is : check the modification date of above files, think, compare to date your site could be hacked.
And restore from previous backup. Because you can omit some infected files.

Modelski.Tomasz@gmail.com
http://IT.tmod.pl

7/24/2009 3:38 PM

Web Architect

Joined: 5/11/2009

Posts: 4

Re: Help! Site hacked. Malware code viewable in source, but how do I find it?

Had to take gscgymcheer.com down. Same error, same location in the code, can be seen at www.silveradoblue.com.

7/24/2009 7:34 PM

Sebastian Leupold

www.dnnwerk.de
Joined: 3/8/2004

Posts: 46212

Re: Help! Site hacked. Malware code viewable in source, but how do I find it?

please contact security@dotnetnuke.com, if you are experiencing security issues and need to contact the experts.

Cheers from Germany,
Sebastian Leupold

Speed up your DNN Websites with TurboDNN

8/4/2009 9:55 PM

Charlie Kreitzberg

Joined: 9/21/2007

Posts: 8

Re: Help! Site hacked. Malware code viewable in source, but how do I find it?

I have had the same problem.

Google flagged one of my sites as dangerous. I found a javascript in it which uses an iframe. I am wondering how it got into the site? Any ideas?

Charlie

Page 1 of 2

1

Help! Site hacked. Malware code viewable in source, but how do I find it?

These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
No Flaming or Trolling.
No Profanity, Racism, or Prejudice.
Site Moderators have the final word on approving / removing a thread or post or comment.
English language posting only, please.

Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

DNN Corp. (DotNetNuke)