Malicious code / pop ups in my blog

  • Hello

    I have a problem with my wordpress blog.
    I’ve been looking at it but I cannot find out from where the problem is coming from.

    I have several pop-ups coming up when you access my blog. I didn’t put any code for this so I’m thinking it’s a malicious code that get inserted I don’t know how.

    I know the pop-ups are NOT coming from my hosting provider.

    My blog adress is
    https://adproject.free.fr/wordpress/

    When you access it pop-ups will come up ! Warning !

    With Firefox, I did tools / page info and here is what I see:

    https://www.maj.com/gallery/chrisdigo/misc/popup.jpg

    I’ve tried to look at the source code, the sidebar template code, header and footer but I don’t find anything.

    Can anybody help me on how can I remove this code and where is it coming from?

    Thank you.

Viewing 11 replies - 1 through 11 (of 11 total)

  • I don’t get any popups from your site, and a page info doesn’t show those links.

    No popups here either.
    Opera reports 103 images though which is a bit much.

    You include a lot of external Javascript in your site so it could be anyone of those, I did have Firefox block popups the first time but it won’t give me the popups again to see what they are so it must be random advertising from one of the services you are using.

    Your front page is absolutely huge, you really should try to trim that down some, a lot of your posts really should use the more link. Plus you have way too much in your sidebar and in MSIE as you don’t have your width’s right the sidebar drops all the way down to the bottom of the page, which usually happens when you have something too wide in there.

    What are the popups you arte getting and does a Google reveal anything about the site?

    Thread Starter chrisdigo

    (@chrisdigo)

    Hello

    Thanks guys for your fast response.

    Me I get a pop up on the opening. However if you do a page info right away, you will not see this:
    https://www.maj.com/gallery/chrisdigo/misc/popup.jpg

    I get this when I do a reload and then again page info !

    Jaseone -> thanks for your advise. Yeah I know my page doesn’t appear right on MSIE. :o( I need to work on it.

    the popups I’m getting comme from

    a.as-eu.falkag.net
    red.as-eu.falkag.net

    here are some popups:
    https://www.maj.com/gallery/chrisdigo/misc/popup1.jpg
    https://www.maj.com/gallery/chrisdigo/misc/popup2.jpg
    https://www.maj.com/gallery/chrisdigo/misc/popup3.jpg

    What do you guys think? Thanks again.

    Go scan your machine ?

    Use adaware, spybot S&D as a minimum, and if you have some resident evil, clean it up.

    I haven’t heard of anything that hijacks Firefox that way though and that is where the original problem was. My guess is either something random from the host or one of the external javascripts included on the page.

    chrisdigo,

    That front page is almost 1mb all up, that is way too big so you really should do some trimming here and there.

    Okay found it…

    Whatever you have in the block:

    <!-- Begin Nedstat Basic code -->

    Is randomly returning more Javascript that contains the code to open the popups, I suggest you use something else for your stats as Nedstat whoever they are don’t seem to be a good choice if they are doing things like that.

    Ahhh……
    https://weblogtoolscollection.com/archives/2005/09/12/sorry-about-the-popups/#comments

    Thread Starter chrisdigo

    (@chrisdigo)

    jaseone -> Thank you !! I removed the Nedstat code and the pop-ups are gone !! So yes it was indeed Webstats4U (former Nedstat) that was causing the problem.

    Podz -> Thanks for the link and the help !

    Well now that the pop-ups are gone I still have to do some clean up in my page as it seems it is too heavy (and to make it looks ok with msie).

    Again, thanks all for your help ! Very much appreciated. Regards.

    Thread Starter chrisdigo

    (@chrisdigo)

    jaseone -> One question do. What did you do to find out ? ;o)

    I reloaded the page until it gave me the popup (that FF blocked and let me know about), then saved the complete page and searched the files using Textpad (all I have on my work PC that can do it, would prefer jEdit on Windows and TextMate on Mac) for falkag then backtracked through the results to see what was causing it.

Viewing 11 replies - 1 through 11 (of 11 total)
  • The topic ‘Malicious code / pop ups in my blog’ is closed to new replies.