Forum Moderators: martinibuster

Message Too Old, No Replies

strange trojan

has adsense been hacked?

         

blairsp

9:01 am on Jun 4, 2004 (gmt 0)

10+ Year Member



Updated my pages last night by placing an alternative url on my adsense code and uploading the new code to my site. This morning when I went in to check all was well my site (all pages)is now launching a "super trojan". The malicious code appears in an iframe and is trying to redirect to <snip> which I presume will hijack any click through revenue

Is this a google problem, an ad sonar(who were my alternative url) or have I been hacked-i.e. anyone else have this problem?

Can't e-mail google as I am at work and can't access my domain e-mail

[edited by: Jenstar at 12:48 pm (utc) on June 4, 2004]
[edit reason] no URLs please [/edit]

Jon_King

12:34 pm on Jun 4, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Are you saying the code for your AdSense block is being replaced with other code?

If so I would start with checking your own system for spyware and viruses.

blairsp

12:38 pm on Jun 4, 2004 (gmt 0)

10+ Year Member



No, there is a new line of code which has appeared on all my pages (all of which have google on them) which I think is trying to hijack my clickthrus. The google ads are still showing but then a new page tries to open which appears to redirect everything (or at least I think it does) to a website <snip> domain.

The only change I made to my site was adding new google code because I had added a default url. It definitely isn't(trojans/virii) on my own machine as I work in a multi machine organisation and it only happened when my site is loaded.

Think I better e-mail adsense to let them know

[edited by: Jenstar at 12:50 pm (utc) on June 4, 2004]
[edit reason] No URLs please [/edit]

Jenstar

12:54 pm on Jun 4, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



1. Check your site on a different machine & see what happens. Some trojans can act on specific URLs, or specific keywords in URLs. If there are no problems, the problem is on your machine.

2. Check the page you have your alternate ad on, and see if there is a problem with the code, and if the problem occurs when viewing your alternate ad page.

3. Upload fresh copies of your affected pages, and see if the problem corrects itself.

I also suspect it is probably something on your machine itself. Have you already run a virus scan as well as something like Spybot/AdAware/HijackThis?

Born_User

1:43 pm on Jun 4, 2004 (gmt 0)

10+ Year Member



I agreee with Jenstar. This type of page manipulation is typically done at the client (user) level. I doubt anyone else is seeing your code that way. If everyone saw your code, the hack would have been at the webserver level, and I doubt that is happening.

However, spybots can alter the way YOUR browser sees webpages, so that when you "view source" you see the way your browser has interpreted the data.

You never know, though... best to check everything. Also run Lavasoft Adaware 6.0 every other day or so.. or on startup.

mquarles

2:01 pm on Jun 4, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



A quick test on many of these is also to try a different browser. If it's on your machine, it may have this effect under Internet Explorer but not with Netscape Navigator.

MQ

blairsp

7:40 pm on Jun 4, 2004 (gmt 0)

10+ Year Member



Solved

I have just received an e-mail from my domain host. It appears they were hacked and this malicious code was placed on all domains that they hosted-which must have been quite a bit of work for the techs as they are manually deleting the code from each web site and each page!-thats service

[edited by: blairsp at 7:41 pm (utc) on June 4, 2004]

annej

7:41 pm on Jun 4, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I've had a hack at the webserver level. It's worth checking.

shortz

9:17 pm on Jun 4, 2004 (gmt 0)

10+ Year Member



which must have been quite a bit of work for the techs as they are manually deleting the code from each web site and each page!-thats service

Hummn.. you'd better hope that they are doing more than just that! Usually, a complete system restore is in order after a hack, as it's virtually impossible to detect exactly how they got in and what critter they might have left lying around that would let them *back* in after all the work to restore..

Are you sure they are not just running a backup into your domain from a previous day, prior to the hack?

Shortz

freitasm

1:02 am on Jun 5, 2004 (gmt 0)

10+ Year Member Top Contributors Of The Month



I think that your ISP should claim all effort costs of recovering back from the company that would be receiving any benefit of this. Perhaps launch an investigation to see if this act of vandalism can be attributed to the company receiving the redirection?

A matter of "who benefits most of a crime" to start with a list of suspects. Of course then the ISP would need to prove that this indeed came from an associate with that company - hard, since anyone anywhere in the world could have done that - even without direct link to the company in case. But if this is an affiliate account, the company could simply terminate the affiliate, just to avoid this kind of problems in the future.

Common sense? Don't quote me, INAL.

blairsp

9:15 pm on Jun 5, 2004 (gmt 0)

10+ Year Member



Its bloomin happened again (other thread). My hosting company appears to want us all to upload our pages again now. Jeez-somebody is probably making a fair bit from adsnese for doing nothing at the moment other than highjacking legitimate clicks

photonstudios

9:37 pm on Jun 5, 2004 (gmt 0)

10+ Year Member



an ad sonar(who were my alternative url) or have I been hacked-i.e. anyone else have this problem?

Are you allowed to have **** for alternative ads? Isn't this against the google TOS?

annej

12:59 am on Jun 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



My impression was that we couldn't have other ads like adsense on the same page. We could have them on different pages on the same site. I'm curious if I have this right.

shortz

1:03 am on Jun 6, 2004 (gmt 0)

10+ Year Member



Its bloomin happened again (other thread). My hosting company appears to want us all to upload our pages again now. Jeez-somebody is probably making a fair bit from adsnese for doing nothing at the moment other than highjacking legitimate clicks

err... did you read my post? If all they did was manually remove the altered code on the pages, then the hacker was, likely, still able to access the server and do it over again..

In cases of hacks, unless your host is far smarter than the hacker, and or, very energitic and has a ton of time to search out every possible place that access tools may have been left by the hacker, then, you will get hacked again.. or, rather, you are *still* hacked..

Shortz

blairsp

6:01 am on Jun 6, 2004 (gmt 0)

10+ Year Member



Yes I did read it but foolishly thought the hosting company could deal with it. However to quote a well used phrase-"Once bitten twice shy"-looking for another host today.