The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
2answers
27 views

How do I prevent access to SPAM URLs and remove them from Google's index?

When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc... Assuming ...
2
votes
2answers
62 views

Server log what does “ho=<something>” mean?

I have got a Joomla site that got hacked and I am looking at the server logs and I see something like: GET /bind.php ...
2
votes
2answers
92 views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the ...
2
votes
2answers
119 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
0
votes
0answers
45 views

Concrete5-based site hacked

It seems my Concrete5-based site has been hacked - found this in my default and homepage templates footers: <div style="position:absolute;left:-6397px;"> <a ...
0
votes
1answer
28 views

imaginaryTeachingToolUrl

I found an increased access to my website on www.mydomain.tld/imaginaryTeachingToolUrl. This isn't a valid URL on my site, I tried to Google this, but there are under 10 results. So I guess this ...
2
votes
5answers
206 views

Chinese bots in my forum

I have a small community forum that doesn't really get posts or any real traffic. The only thing that happens on the regular is bots with Chinese IPs signing up gibberish usernames. Most bots don't ...
1
vote
1answer
73 views

Site hacked: redirecting to other site?

I have a site that appears and works fine. However if you search for it in Google a whole lot of other links come up, eg: mysite.com/kamagra-viagra.html Clicking this I get redirected to the ...
0
votes
1answer
56 views

How to determine if someone is accessing our database remotely?

I own a content publishing website developed using CakePHP(tm) v 2.1.2 and 5.1.63 MySQL. It was developed by a freelance developer who kept remote access to the database which I wasn’t aware of. One ...
2
votes
1answer
56 views

What was this hack-bot trying to achieve via directory traversal?

I was walking through my server logs and the following kinda stunned me: ACCESS ERROR 404 from IP 62.112.152.161: Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00 ...
1
vote
2answers
58 views

How can we find real source of suspected user entries?

I have a website where I keep logging the user entries. I found some anonymous entries in my table and I suspect they are using some kind of proxy switchers. How can I find the real source of these ...
6
votes
2answers
309 views

New requests for /cache/ URLs

A few weeks ago requests following this type of pattern: http://mysite/cache/7a226e8aa3a4380444a329a7b0dd0f40 http://mysite/otherfolder/cache/7a226e8aa3a4380444a329a7b0dd0f40 started to appear ...
4
votes
2answers
163 views

Website hack resulting in auto redirect - where to start looking?

My website is being redirected to a non-existent page (/showpage.php) for some users when they hit the homepage. For other users, the site works fine. I have looked in the index.php files and some ...
1
vote
2answers
1k views

What is HTML:imghack-a [Trj]?

One of my websites (Joomla) is being blocked by Avast when I try to go to the administrator page. I get the message that there is an HTML:imghack-a [Trj] threat. I guess its a trojan, but I cannot ...
2
votes
2answers
125 views

Safely backup and migrate a hacked and infected WordPress site

I have an old WordPress site that was on really bad shared hosting and has been hacked into smithereens. It's been compromised by multiple (different) people, as far as I can tell. It's pretty bad! ...
2
votes
1answer
381 views

Site hack… but what is this?

My site have been hacked (i think) here is the code... the question, how to find what it does... <?php $zend_framework="\x63\162\x65\141\x74\145\x5f\146\x75\156\x63\164\x69\157\x6e"; ...
1
vote
3answers
1k views

My website has been hacked/attacked, says “reported attack page”

Three days back my website ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided by Free ...
6
votes
2answers
725 views

Why do hackers inject hidden links?

I discovered a hacked site recently which has a div in it with a bunch of links to casinos at the top and the div is display:none;. I understand that black hats may hack sites in order to gain ...
3
votes
2answers
80 views

Am I being hacked or harvested? [closed]

I just did some log analysis of Q1 for one of my client's sites. There were about 30,000 sessions created for this site for each of the five separate IP addresses starting with 79.171.81.xxx. 150,000 ...
1
vote
1answer
90 views

.htaccess keeps being deleted from my root directory

I have a site built on the ModX Evo CMS. I have noticed that almost every day the .htaccess file is deleted meaning the FURLs no longer work. I have scanned for viruses and found nothing. Does anyone ...
0
votes
1answer
191 views

JQuery Plugin files getting viruses even with CHMOD 755

I have a bunch of JQuery plugins (eg: masonry, isotope, carousel, etc) within a JavaScript folder in my root. These have been repeatedly infected with viruses making Google put alerts on my site. The ...
-1
votes
1answer
183 views

Need help in removing and forbidding some kind of malware in my website [closed]

I have a website based on Joomla 2.5. Recently people with AVG anti-virus started to complain that some strange windows appear when they open the site. An unknown line of code with comments "Google ...
2
votes
1answer
124 views

Script injection on different hosting servers = FTP hacking?

I've been facing the exact same injected script on several of my websites for the last few weeks. Today I realize these websites don't share the same hosting servers, yet the attacks (1) started at ...
2
votes
2answers
195 views

Any suggestions for a change detection system?

As a webdesigner/webmaster I'm taking care of various websites. Recently one client's website got "hacked". It turned out that at their office one computer got infected by a trojan, that spied the ftp ...
2
votes
1answer
3k views

Are these hacking attempts or something less sinister?

I just had a look through our web server error logs, and Terminal services is reporting: "Remote session from client name a exceeded the maximum allowed failed logon attempts. The session was ...
6
votes
4answers
332 views

How to discredit hacked links pointing at my company's website

The competition of one of my company's websites has started a really dirty campaign of acquiring hack links. One of their ingenious tactics has been to seed in links to OUR site withing their hack ...
2
votes
1answer
1k views

Joomla Sites hacked by DR-MTMRD [duplicate]

Possible Duplicate: My Sites Were Hacked. What To Do? A few of my joomla sites were hacked. After I became aware of this, I did these things: Changed hosting passwords (mysql, ftp, control ...
5
votes
1answer
152 views

Repeated calls with random Javascript append to the URL

I keep getting calls to my server where there is random Javascript appended on the end of lots of the calls, e.g.: /UI/Includes/JavaScript/).length)&&e.error( ...
6
votes
2answers
178 views

Meaning of hack request

We've been logging GET requests on our domain to the following: XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG Is this a known kind of attack? What might it be targeting?
2
votes
2answers
4k views

How can I fix the #c3284d# malvertising hack on my website?

For the past couple of weeks at semi regular intervals, this website has had the #c3284d# malware code inserted into some of its .php files. Also the .htaccess file had its equivelant code inserted. I ...
1
vote
2answers
3k views

Website hacked, cpanel password not encrypted?

Yesterday I found out that all the websites that are hosted on my webhosting site were hacked. I tried to change my password, and unbelievably, I COULD SEE my password there. This means my password is ...
2
votes
1answer
462 views

IIS executes “malicious.asp;.txt” as ASP file. What the?

I investigated a situation where 300+ websites hosted on an IIS server were pwned by a hacker. Investigation led me to a text file that contained malicious ASP-classic code. The file was named ...
1
vote
1answer
272 views

What can I do about Hack Attempts

I have an ASP.net website hosted using the Ultidev Web Server Pro. Every day I get a steady stream of errors generated by my application where page requests were requested and denied. This is ...
1
vote
4answers
125 views

Visitors download files in the same order every time - am I being hacked?

I'm running a website for a while and I'm still learning how to manage it. One thing I've noticed is that some visitors download all zip files in the same order ( there is a pattern of downloads). ...
0
votes
2answers
324 views

Traffic from site like pu.gg, goo.gl?

Why is it that I get pageviews from sites like pu.gg, goo.gl? What does it mean? Am I visited by hackers? Is there any way to block this kind of page view from my analytics? I am kind'a alarm with ...
2
votes
2answers
180 views

How does Google prevent GA accounts from being spammed [closed]

Since the Google Analytics snippet is available in the source code of the page (e.g. below is stackexchange's) <script type="text/javascript">var ...
1
vote
2answers
375 views

How to fix some damages from site hack?

My site had been hacked. I found vulnerability,fixed it, and removed shell scripts. But hacker had uploaded thousands of web pages on my web server. after I removed those pages I got over 4 thousand ...
1
vote
1answer
459 views

My WP site got injected [closed]

Hey friends my wordpress site got injected, and now I have to solve it. here is my domain, http://webstutorial.com/ What I need to do, please help me. This is not a spam or link building technique ...
2
votes
2answers
432 views

Should WHMCS hacking attemps that never succeed be important to me?

I have WHMCS and I use it with no problem for my hosting purposes. Almost every 2 or 3 days, I can see a spam with malicious content submitted as a new ticket that tries to hack. The last one was: ...
0
votes
2answers
543 views

Hacked .htaccess - Inconsistent Results

At present a large number of .htaccess files are being created in various website folders throughout the site. Current .htaccess files are also being modified to include the following (cleaned up) ...
5
votes
3answers
712 views

My Sites Were Hacked. What To Do?

I host multiple domains with this very popular hosting provider and I just went into one of my sites and... I see a black page with message "Hacked by...". I checked and all my sites with the provider ...
4
votes
7answers
442 views

Hacked by our own hosting company!

OK, so our hosting company decided to clone our site and database onto a new serve. Without our knowledge or permission they then edited our code to point to the new database. The old server was left ...
2
votes
2answers
112 views

Are we being attacked?

We serve a 13mb download which is reasonably popular, around 150-300 downloads a day. Today we have had 1,200 downloads and as I browse the logs I find they all originate from the same IP address. ...
2
votes
3answers
321 views

POST attack on my website

I have a site (humanisms.co.uk) which incorporates a voting system, ie. user clicks "Up" and it sends a parameter to a PHP script via AJAX, the PHP inserts vote into MYSQL db and the new "Up" vote is ...
6
votes
1answer
316 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
0
votes
1answer
438 views

someone was able to upload php files without ftp access to my server

I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc ...
2
votes
3answers
304 views

Hacker Crawler inserting iframe into ftp file

Somehow, a "hacker crawler" is constantly inserting a harmful iframe-line into one of my files: It's done automatically, and not by a person, I assume. I've changed all my passwords several times ...
2
votes
1answer
120 views

Effective combatting of 100's of spam links in Google Results

I have recently been the victim of this hacking exploit (blog post is for reference only and is not my site. I'm in the process of following it and cleaning up after the attack). Note the exploit at ...
4
votes
3answers
729 views

Google says my site contains malware

my clients site http://bit.ly/dTOfGF (i used url shortener). I have tried everything to find the malware but i couldnt. I tried the Google checklist ...
1
vote
3answers
243 views

How could this site have been infected?

I run a small website on some Joomla 1.5 version. It appears that today it was hacked: The index.php and index2.php files were overwritten, the administrator account had its password changed, and the ...