11 replies to this topic

[fabcards]

Not sure if my site has been hacked but when i view the page source at the bottom of most pages i can see links to a load of other sites?....Have i been hacked? How do i remove these links? Are they dangerous?

www.fabcards.ie

[DunWeb]

@fabcards

I don't see any signs of hacker activity and the only thing I see loaded remotely is your Google Analytics.......



Chris

[fabcards]

but when i view source at the bottom i get a load of rubbish like


<!-- [90cbc035f8d7ea32fbc6434d3ce91443 --><!-- 8428386921 --><a href="javascript:document.getElementById('block28').style.display='block';" title="more"> </a><div id="block28" style="display:none"><ul><li><a href="http://notwriting.com/commentary_111002.htm?cheap_pill=774">how much does mobic cost</a></li><li><a href="http://notwriting.com

Lookign at my files on the hosting server i see some files in the catalog/pub directory that i dont see on my local copy.  viewed some of these files and inside mentions a pakistan hacker???There are two new folders in there Bomba and Bomba1 and inside these are aload of files with no file type so i cant seem to do anything with them...download nor delete.....am i safe enough to delete these folders or could this bring down my site altogether?

[geoffreywalton]

It does look like you have been hacked.

There are loads of posts listing what you need to do to cleanse your site and block the known route the hackers can use on unsecured site.

I have PM'd some usefull info.

Cheers

G

[DunWeb]

@fabcards

Odd, I don't see it when I view your source............


Chris

[fabcards]

this is a page im viewing the source of
http://fabcards.ie/oscommerce2/catalog/product_info.php?cPath=22_35&products_id=63.
Maybe its only on some pages

[germ]

A few years ago there was a hack going around that only displayed the hack links if you were a web bot indexing a site.

The hack had the IP addresses of all the major search engines and only spit out  the extra links if the IP of the visitor matched one on their list.

The only way for the "average joe" to see the links was to view g00gle's cache of the site.

Somehow the cache isn't always available on g00gle now like it was a few years ago.

[germ]

fabcards, on 08 August 2012 - 04:57 PM, said:

this is a page im viewing the source of
http://fabcards.ie/oscommerce2/catalog/product_info.php?cPath=22_35&products_id=63.
Maybe its only on some pages

Definitely hacked.

[fabcards]

any idea of how it can be removed?

[germ]

Find the hack file(s) and remove it(them).

[fabcards]

Looking at my files on the hosting server i see some files in the catalog/pub directory that i dont see on my local copy. viewed some of these files and inside mentions a pakistan hacker???There are two new folders in there Bomba and Bomba1 and inside these are aload of files with no file type so i cant seem to do anything with them...download nor delete.....am i safe enough to delete these folders or could this bring down my site altogether?  I dont want to risk downloading the folders to my local computer but am afraid if i delete i may mess up my whole website????

[geoffreywalton]

You can always zip up your site and keep a "security" copy.

But if "someone" had added them you definately don't want to keep them on your server.

Cheers

G