Forum Moderators: martinibuster
I recently discovered that someone replaced the adsense code on my websites. So far the code has been changed on 35 sites and I'm still manually checking 277 of them! My domains are on a dedicated server and I'm in the process of changing the passwords. I've also been in touch with Google and waiting for a response. How common is this? Thanks in advance for your feedback!
Lana
By the way, don't forget to report the PUB-ID in the new code you discovered to Google.
SITES or PAGES?
Or, like Alioc said, maybe someone from your webhost/datacenter did this.
But yes... it sounds like a hack job.
Lana
[edited by: martinibuster at 12:36 am (utc) on Mar. 19, 2006]
[edit reason] Removed specifics. [/edit]
Lana
[edited by: martinibuster at 12:37 am (utc) on Mar. 19, 2006]
[edit reason] Removed Specifics. [/edit]
1.Check your logs in /var/log/messages for any interesting messages which might
have been logged by a ftp server if one was present
When I asked what did this mean I received the second reply:
You can do it using following command on shell as a root user.
#cat /var/log/message ¦ grep <username/domain.com>
When I asked what is a shell and how specifically do I do this, I received the third reply:
A shell is the command line for linux, similar to the DOS Prompt of windows. You use a program such as PuTTY (free software) to connect to it. This allows you to fully control your server.
?
Lana
[edited by: martinibuster at 12:38 am (utc) on Mar. 19, 2006]
[edit reason] Removed specifics. [/edit]
This guy is a jerk? Now I understand how you have 277 "sites".
Lana
Lana
Pardon me, but I'm a bit confused --
1.) Are you saying that at least some of what you call 'your websites' began or exist as others' sites and that you 'built' them elsewhere?
2.) Is what you're calling "my income" generated from ads you've placed on your (re)built, online versions of those other sites?
3.) When you refer to domains, do you mean you own 200-plus domains, or do you mean you have multiple 'domains' listed off a main site? (Like, oh, www.example.com/www.example2.com)
What hapens when there is a security alert and you need to recompile a patch into apache webserver or somthing?
Unless its a managed server in that case just tell whoever manages it that you have been rooted and it needs to be fixed.
Changing the adsense code back to yours is just the start of it, you need to find out what comprimised it in the first place or you will have a loosing battle replaceing adsense code on multiple files is a trivial task done with a one liner in the shell, if you are doing a manual fix its gonna take you 2 days what the hacker did in under a minute.
Check what the costs of a managed server is to avoid this happening again while you learn what you need to know to manage it yourself
It looks like some of us may have forgot our manners.
WBF
1. Don't use FTP or Telnet if you can possibly help it as they are not secure (i.e. encrypted). This is a security risk in itself. Use Putty as mentioned by your host, and a file transfer client based on that such as WinSCP.
2. Most webmasters here don't care for scraper sites such as you are describing, so suffice it to say you will probably get a rough ride on that subject.
Anyway good luck tracking down the source of the problem. If it does turn out that your server was hacked into, you might have no choice but to wipe the HD and start over. Anyway take your web host's advice on the matter.
Lana
