img

It some code embedded in curvycorners.js.

So did you solve your problem by identifying the curvycorners.js thing?

Not sure if this means someone gained access to your server, or if that file you downloaded was like that to begin with. If the former, you definitely want to change passwords. If the latter, then you probably want to find a different source for the javascript (or use something else entirely).

A third possibility is some kind of XSS (cross-site-scripting) attach -- maybe? Do you have comments enabled on portions of the site? Any other forms on the front-end that people can use? Perhaps custom-made ones that don't filter input or output properly?

Good luck.

-Jordan

Jordanlev,

Thanks for the help. Turns out they have a 'friend' doing some work on the site and he's been installing some bad scripts. I told them ftp was dangerous for the uninitiated.

Steve