Prepend Field, Zone Table - Strange Content .....

[Khunsuk]

I just debugging a new website and 404 came up for http://ads.eurowebcorp.com/www/images/1x1.swf

 

 

I found this revive 3.1 in table 'rv_zones' in field 'prepend'

 

<object type="application/x-shockwave-flash" data="http://ads.example.com/www/images/1x1.swf" width="1" height="1"></object>

 

Anybody a guess what it is, how it came into that field ?

 

Thanks for your help / comments

Edited June 1, 2015 by Erik Geurts
removed domain to protect others

[Erik Geurts]

It looks like your system was hacked.

[Khunsuk]

Hi Erik,

Thanks a lot for your reply.

 

BTW: Installed from scratch 1 year ago.

 

I removed all the 'prepend' fields in the rv_zones tables.

(checked .. tables for additl. users etc.. nile; checked banners table .. seems fine, no php files in the image dir.)

 

I upgraded today to version 3.2  (as suggested..... extracted the db and imported into a new revive_..32 one.)

 

Do you think I am fine now ? or any suggestion.

 

Thanks a lot.

[andrewatfornax]

The following may be of help:

 

http://www.reviveconsultant.com/articles/what-to-do-when-you-suspect-your-openx-source-system-has-been-hacked/