Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Some friends of mine have a website ( and I'm trying to help them when there is any trouble. However this time I, can't figure it out. When I visit the site using Google Chrome, I'm presented with a warning page claiming that the page that I'm trying to visit contains elements from

I don't know any PHP, so I simply downloaded the complete website including backups of the database (which are .sql files). Then, I searched all the files for stopssse, but I didn't find anything.

I also tested the site with it says "We tested this site and didn't find any significant problems".

Can PHP hide a reference to the malware site so I cant find it with a simple search? If so, how can you find it?

share|improve this question

migrated from Sep 1 '09 at 12:07

This question came from our site for professional and enthusiast programmers.

up vote 5 down vote accepted

I found this in the generated source

<iframe height="0" width="0" src="" style="display: none; visibility: hidden;">

It was right below the body tag, it's not in the actual page source, it's being added by obfuscated javascript

edit: if you look at the bottom of you'll see a really odd looking javascript function. That's the obfuscated javascript function I was telling you about. It starts with

function lIIlOlIllI1000llII10l0OIIIlIOlIOI1O010l0(O00I10I0l00I0IOIO1Ol10O0Ol1Il1lI10OI00Il){var

Best bet is to find and remove it.

share|improve this answer
+1 Definitely the culpret want to remove it and also importantly find out how it got in there. – Mark Davidson Sep 1 '09 at 12:57
Yes good point, I imagine that because it's powered by php fusion that there is some security hole in the product itself, it's worth checking whether your version is up to date, you may also be able to replace all the files with the exception of the main configuration file without losing any content. – Stephen Lacy Sep 1 '09 at 13:07
Thank you very much. That did the trick. How did you did you see the generated source? If i right clic in the browser and picked show source I didnt that part of the code. – CruelIO Sep 1 '09 at 14:56
Web Developer toolbar in firefox allows you to see the generated source code. – Mark Davidson Sep 1 '09 at 16:00
Firebug is also quite useful for that – Stephen Lacy Sep 2 '09 at 9:47

Your are most probably dealing with XSS attacks.

In that case, two steps :

  • Scan the DB, looking for "scripts" tags, and get rid of them.
  • Hire a guy who knows PHP to fix the holes in your data input and set some efficient sanitizing policy.
share|improve this answer

The malware might not be on the site, but might be coming from material brought in from external sources, such as advertisements.

share|improve this answer

If the site was "infected" via cross-site scripting, then what you have is probably a user-submitted comment somewhere that contains something like this:


But note that there are many variations that attempt to hide the fact that an external script is executed, and which may also modify the source URL, causing your simple string search to fail.

share|improve this answer

The version of PHP-Fusion that's running on the site appears to be v6.01.3, which looks to be a pretty old version, so it would probably be a good idea to upgrade that.

There seems to have been quite a few security advisories for PHP-Fusion, including a number of SQL injections issues.

Full list of advisories for PHP-Fusion here:

share|improve this answer

Look for any peculiar files in the actual directories. There may be a file that was uploaded via an unsecure upload-form that writes additional data to the output. Tell your friend to change his account information, and start reviewing the security of his site.

share|improve this answer

It's there, check the PHP files (search for stopssse).

share|improve this answer

In the general case, looking for obfuscated javascrot, this tool is often useful: Wepawet

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.