The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
45 views

How to prevent TYNT from inserting Iframes into my site [closed]

I have a wordpress site and since two days ago an iframe is showing up above the </body> tag. The iframes are not always the same and they wont show up everytime, they show up like 90% of the ...
3
votes
4answers
273 views

Wordpress site hacked numerous times

Because of the identity of the website, I don't want to give too much identifying information about the actual organization, but I can try to provide as much server background information as possible. ...
1
vote
2answers
41 views

After the home page was redirected by a hack, it is no longer indexed. How long until it comes back?

My site was hacked, and the index page was 302 redirected. It took me a few months to get all this sorted. In the meantime, the home page lost its PageRank and was no longer included in the index. I ...
0
votes
1answer
35 views

Reset Connection causing multiple errors after hack

We use webmaster tools to monitor our websites, and in the past couple of months some of our sites have been compromised and had various pages inserted. These pages created URLs that Google would ...
1
vote
2answers
53 views

How do I prevent access to SPAM URLs and remove them from Google's index?

When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc... Assuming ...
2
votes
2answers
132 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
0
votes
0answers
75 views

Concrete5-based site hacked

It seems my Concrete5-based site has been hacked - found this in my default and homepage templates footers: <div style="position:absolute;left:-6397px;"> <a ...
0
votes
1answer
44 views

imaginaryTeachingToolUrl

I found an increased access to my website on www.mydomain.tld/imaginaryTeachingToolUrl. This isn't a valid URL on my site, I tried to Google this, but there are under 10 results. So I guess this ...
2
votes
2answers
127 views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the ...
2
votes
1answer
74 views

What was this hack-bot trying to achieve via directory traversal?

I was walking through my server logs and the following kinda stunned me: ACCESS ERROR 404 from IP 62.112.152.161: Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00 ...
1
vote
1answer
94 views

Site hacked: redirecting to other site?

I have a site that appears and works fine. However if you search for it in Google a whole lot of other links come up, eg: mysite.com/kamagra-viagra.html Clicking this I get redirected to the ...
1
vote
2answers
65 views

How can we find real source of suspected user entries?

I have a website where I keep logging the user entries. I found some anonymous entries in my table and I suspect they are using some kind of proxy switchers. How can I find the real source of these ...
2
votes
5answers
289 views

Chinese bots in my forum

I have a small community forum that doesn't really get posts or any real traffic. The only thing that happens on the regular is bots with Chinese IPs signing up gibberish usernames. Most bots don't ...
0
votes
1answer
60 views

How to determine if someone is accessing our database remotely?

I own a content publishing website developed using CakePHP(tm) v 2.1.2 and 5.1.63 MySQL. It was developed by a freelance developer who kept remote access to the database which I wasn’t aware of. One ...
4
votes
2answers
167 views

Website hack resulting in auto redirect - where to start looking?

My website is being redirected to a non-existent page (/showpage.php) for some users when they hit the homepage. For other users, the site works fine. I have looked in the index.php files and some ...
2
votes
2answers
144 views

Safely backup and migrate a hacked and infected WordPress site

I have an old WordPress site that was on really bad shared hosting and has been hacked into smithereens. It's been compromised by multiple (different) people, as far as I can tell. It's pretty bad! ...
2
votes
1answer
425 views

Site hack… but what is this?

My site have been hacked (i think) here is the code... the question, how to find what it does... <?php $zend_framework="\x63\162\x65\141\x74\145\x5f\146\x75\156\x63\164\x69\157\x6e"; ...
2
votes
2answers
74 views

Server log what does “ho=<something>” mean?

I have got a Joomla site that got hacked and I am looking at the server logs and I see something like: GET /bind.php ...
6
votes
2answers
749 views

Why do hackers inject hidden links?

I discovered a hacked site recently which has a div in it with a bunch of links to casinos at the top and the div is display:none;. I understand that black hats may hack sites in order to gain ...
3
votes
2answers
86 views

Am I being hacked or harvested? [closed]

I just did some log analysis of Q1 for one of my client's sites. There were about 30,000 sessions created for this site for each of the five separate IP addresses starting with 79.171.81.xxx. 150,000 ...
1
vote
1answer
110 views

.htaccess keeps being deleted from my root directory

I have a site built on the ModX Evo CMS. I have noticed that almost every day the .htaccess file is deleted meaning the FURLs no longer work. I have scanned for viruses and found nothing. Does anyone ...
0
votes
1answer
226 views

JQuery Plugin files getting viruses even with CHMOD 755

I have a bunch of JQuery plugins (eg: masonry, isotope, carousel, etc) within a JavaScript folder in my root. These have been repeatedly infected with viruses making Google put alerts on my site. The ...
-1
votes
1answer
199 views

Need help in removing and forbidding some kind of malware in my website [closed]

I have a website based on Joomla 2.5. Recently people with AVG anti-virus started to complain that some strange windows appear when they open the site. An unknown line of code with comments "Google ...
2
votes
1answer
135 views

Script injection on different hosting servers = FTP hacking?

I've been facing the exact same injected script on several of my websites for the last few weeks. Today I realize these websites don't share the same hosting servers, yet the attacks (1) started at ...
2
votes
2answers
210 views

Any suggestions for a change detection system?

As a webdesigner/webmaster I'm taking care of various websites. Recently one client's website got "hacked". It turned out that at their office one computer got infected by a trojan, that spied the ftp ...
6
votes
2answers
181 views

Meaning of hack request

We've been logging GET requests on our domain to the following: XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG Is this a known kind of attack? What might it be targeting?
1
vote
1answer
298 views

What can I do about Hack Attempts

I have an ASP.net website hosted using the Ultidev Web Server Pro. Every day I get a steady stream of errors generated by my application where page requests were requested and denied. This is ...
2
votes
1answer
540 views

IIS executes “malicious.asp;.txt” as ASP file. What the?

I investigated a situation where 300+ websites hosted on an IIS server were pwned by a hacker. Investigation led me to a text file that contained malicious ASP-classic code. The file was named ...
5
votes
1answer
161 views

Repeated calls with random Javascript append to the URL

I keep getting calls to my server where there is random Javascript appended on the end of lots of the calls, e.g.: /UI/Includes/JavaScript/).length)&&e.error( ...
2
votes
1answer
3k views

Are these hacking attempts or something less sinister?

I just had a look through our web server error logs, and Terminal services is reporting: "Remote session from client name a exceeded the maximum allowed failed logon attempts. The session was ...
2
votes
1answer
1k views

Joomla Sites hacked by DR-MTMRD [duplicate]

Possible Duplicate: My Sites Were Hacked. What To Do? A few of my joomla sites were hacked. After I became aware of this, I did these things: Changed hosting passwords (mysql, ftp, control ...
2
votes
2answers
4k views

How can I fix the #c3284d# malvertising hack on my website?

For the past couple of weeks at semi regular intervals, this website has had the #c3284d# malware code inserted into some of its .php files. Also the .htaccess file had its equivelant code inserted. I ...
1
vote
2answers
3k views

Website hacked, cpanel password not encrypted?

Yesterday I found out that all the websites that are hosted on my webhosting site were hacked. I tried to change my password, and unbelievably, I COULD SEE my password there. This means my password is ...
0
votes
2answers
355 views

Traffic from site like pu.gg, goo.gl?

Why is it that I get pageviews from sites like pu.gg, goo.gl? What does it mean? Am I visited by hackers? Is there any way to block this kind of page view from my analytics? I am kind'a alarm with ...
6
votes
2answers
315 views

New requests for /cache/ URLs

A few weeks ago requests following this type of pattern: http://mysite/cache/7a226e8aa3a4380444a329a7b0dd0f40 http://mysite/otherfolder/cache/7a226e8aa3a4380444a329a7b0dd0f40 started to appear ...
2
votes
2answers
188 views

How does Google prevent GA accounts from being spammed [closed]

Since the Google Analytics snippet is available in the source code of the page (e.g. below is stackexchange's) <script type="text/javascript">var ...
1
vote
2answers
383 views

How to fix some damages from site hack?

My site had been hacked. I found vulnerability,fixed it, and removed shell scripts. But hacker had uploaded thousands of web pages on my web server. after I removed those pages I got over 4 thousand ...
1
vote
1answer
463 views

My WP site got injected [closed]

Hey friends my wordpress site got injected, and now I have to solve it. here is my domain, http://webstutorial.com/ What I need to do, please help me. This is not a spam or link building technique ...
2
votes
2answers
461 views

Should WHMCS hacking attemps that never succeed be important to me?

I have WHMCS and I use it with no problem for my hosting purposes. Almost every 2 or 3 days, I can see a spam with malicious content submitted as a new ticket that tries to hack. The last one was: ...
0
votes
2answers
544 views

Hacked .htaccess - Inconsistent Results

At present a large number of .htaccess files are being created in various website folders throughout the site. Current .htaccess files are also being modified to include the following (cleaned up) ...
5
votes
3answers
723 views

My Sites Were Hacked. What To Do?

I host multiple domains with this very popular hosting provider and I just went into one of my sites and... I see a black page with message "Hacked by...". I checked and all my sites with the provider ...
1
vote
4answers
126 views

Visitors download files in the same order every time - am I being hacked?

I'm running a website for a while and I'm still learning how to manage it. One thing I've noticed is that some visitors download all zip files in the same order ( there is a pattern of downloads). ...
2
votes
2answers
112 views

Are we being attacked?

We serve a 13mb download which is reasonably popular, around 150-300 downloads a day. Today we have had 1,200 downloads and as I browse the logs I find they all originate from the same IP address. ...
6
votes
1answer
329 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
0
votes
1answer
502 views

someone was able to upload php files without ftp access to my server

I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc ...
1
vote
2answers
1k views

What is HTML:imghack-a [Trj]?

One of my websites (Joomla) is being blocked by Avast when I try to go to the administrator page. I get the message that there is an HTML:imghack-a [Trj] threat. I guess its a trojan, but I cannot ...
2
votes
1answer
123 views

Effective combatting of 100's of spam links in Google Results

I have recently been the victim of this hacking exploit (blog post is for reference only and is not my site. I'm in the process of following it and cleaning up after the attack). Note the exploit at ...
2
votes
3answers
325 views

Hacker Crawler inserting iframe into ftp file

Somehow, a "hacker crawler" is constantly inserting a harmful iframe-line into one of my files: It's done automatically, and not by a person, I assume. I've changed all my passwords several times ...
4
votes
3answers
765 views

Google says my site contains malware

my clients site http://bit.ly/dTOfGF (i used url shortener). I have tried everything to find the malware but i couldnt. I tried the Google checklist ...
6
votes
4answers
339 views

How to discredit hacked links pointing at my company's website

The competition of one of my company's websites has started a really dirty campaign of acquiring hack links. One of their ingenious tactics has been to seed in links to OUR site withing their hack ...