Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A site I work with was recently hacked and some malicious php code was found in the page. Even trying to download the code, MSE tagged it as a trojan. I have removed the php and changed the ftp/shell passwords. Google webmaster tools reported malicious code on several pages some with these parameters:

?publisher=localcom_rbl&placement=octane360

I've googled this and found it on tons of sites, but I don't know what it means. It's certainly not mine.

Does this point to a particular culprit? And are there further steps I should take to protect the site? Could they have left something behind besides their php code?

share|improve this question

1 Answer 1

I have not seen this before, so this is speculation based on circumstantial evidence - but I suspect speculation is about as good as we are going to get without knowing the name of the trojan and further details (for example IP addresses associated with those URL calls).

It would appear that this has something to do with "local.com" and an advertising "solution provider" they own called Octane 360. (See here). My guess is that this advertising agency is serving up malware. Whether it is serving it up and using your computer to help (which might be the case if the script you deleted handles those parameters and the IP's hitting it are from the wider Internet) or if Google or another bot is checking the site for Malware and using that as a clue to help you track down the cause (in which case the referer line in the log might give you a clue) can't be determined with the information at hand.

It is impossible to say whether they have left behind something - you would really need to work out how they managed to inject the code into your site in the first place and eliminate that vector. Depending on the vector you would need to take a view as to how much damage they could have done, and what exactly they could have modified, and then check for that.

As an RBL has been intimated, you should check your IP address and domain name against a multi-RBL checklist to see if its blacklisted and take steps to "unlist" it if it is. This could also provide a useful hint as how the site was compromised if the RBL provides further information.

Realistically, unless you have the knowledge to track down what they did and how they did it, you should call in a professional to help - no one can realistically provide an answer to you without a lot more knowledge of your particular environment and circumstance.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.