Hey all, two different people recently had AVG pop up with a message on my website saying there was a phoenix exploit kit tooling around in it. Zenphoto is the only thing I have in my domain, and the only modification I've made is to add an ebay button. What do you think could be the problem?
www[dot]matthicksphoto[dot]com

I don't know much about that but what I read so far is that a root kit trojan for Windows computers. So it might be on the visitors computer/browser and not on your server.

I fear I sadly cannot help further you will have to check available resources how to get rid of that.

Although it was something different (I think) you can read on the security posts on our news section from last november about Zenphoto powered sites being hacked.

Thanks, I looked through a few topics and then realized my install was out of date, so I updated it...I think. The version that zenphoto says I have is different from what my control panel says I have.
Well, we'll just have to see if it happens again! I certainly couldn't reproduce it in clicking around my website for 15 minutes.

Your site tried to install a virus on my computer, straight from the homepage and without clicking. In the top-center of your homepage I noticed two 1x1-pixel iframes linking to a website in Poland (miporoskilosi[dot]bee[dot]pl) and they contain very suspicious encrypted code...

Seems then that you need to do some cleaning and check your file/folder permissions and else. You should also contact your host in case it got in via the server directly.

I found this out a bit before you did, and I've been combing through files, but haven't found it yet. It's an iframe that isn't in any of the theme files. My host was...unhelpful.

Look also for strange Javascript or PHP code as the iFrame might be camouflaged. Also look into the database.

Best is to clear the whole install and reupload all files fresh downloaded from our site (and of any other tool you might use).