Thread:Project:Support desk/Insertion of Code Attack

Hello,

I installed Media wiki recently and have been working on getting setup. Today I got reports of the site had been hacked and found that HTML code was being add to the bottom of the page that called a redirect script to fairbankhouston.cz.cc/jquery.js

I attempted to find where this code is coming from and couldn't find it in any of the pages. So I removed all the mediawiki files from the sever and installed it fresh then added my LocalSettings.php back in.

The code showed back up when I did. I've tried searching the database to see if this is coming from there and can't find it.

Can anyone point me to any suggestions on how to find where this code coming from.

MediaWiki 	1.16.5 PHP 	5.2.17 (cgi) MySQL 	5.0.91-log

The URL is http://www.gaslightsaga.com/