Hello,
I've recently noticed when viewing the source of my website, I have 'spam' in the top of the page:
<span style="height: 1pt;width: 1pt;position: absolute;overflow: auto;"> <a href="http://arthistoricum.net/blog/page.php?page=zocor-vs-lipitor.html">zocor vs lipitor</a> <a href="http://arthistoricum.net/blog/page.php?page=what-is-lipitor.html">what is lipitor</a> <a href="http://arthistoricum.net/blog/page.php?page=what-is-zyrtec.html">what is zyrtec</a>
It goes on from there, but I'm concerned as to how this may have happened, and what I can do to fix and prevent it from happening again.
Any ideas? I'm using Drupal 6.13.
You should look at "My site was defaced("hacked"). Now what?" at:
Dave
-----Original Message----- From: support-bounces@drupal.org [mailto:support-bounces@drupal.org] On Behalf Of george Sent: Tuesday, August 18, 2009 10:18 AM To: Drupal Support Subject: [support] Spam in page header
Hello,
I've recently noticed when viewing the source of my website, I have 'spam' in the top of the page:
<span style="height: 1pt;width: 1pt;position: absolute;overflow: auto;"> <a href="http://arthistoricum.net/blog/page.php?page=zocor-vs-lipitor.html"
zocor
vs lipitor</a> <a href="http://arthistoricum.net/blog/page.php?page=what-is-lipitor.html"> what is lipitor</a> <a href="http://arthistoricum.net/blog/page.php?page=what-is-zyrtec.html">w hat is zyrtec</a>
It goes on from there, but I'm concerned as to how this may have happened, and what I can do to fix and prevent it from happening again.
Any ideas? I'm using Drupal 6.13. -- [ Drupal support list | http://lists.drupal.org/ ]
On Tue, Aug 18, 2009 at 12:36 PM, Metzler, Davidmetzlerd@evergreen.edu wrote:
You should look at "My site was defaced("hacked"). Now what?" at:
Thank you. It looks like my template.tpl.php file was somehow tampered with.
A freelancer I once knew got a virus on his pc (sandbox). The virus editted *all* his .php, .htm .html files and added this kind of spam to them. He unknowingly uploaded the files to his host.
He had about 10 clients at that time, so you can imagine the mess and stress. He had to wipe his pc and go through all that code with a comb.
So the point of infiltration may be your pc/mac itself. Don't assume it's a hacker. I've been in web development for 3 years and never once encountered a malicious hacker *touch wood*.
The possibility of your host getting hacked exists, but it's a slim chance compared to a worm/virus on your machine.
Hope you fix it :)
Cheers Alex
On Wed, Aug 19, 2009 at 1:40 AM, george georgedamonkey@gmail.com wrote:
On Tue, Aug 18, 2009 at 12:36 PM, Metzler, Davidmetzlerd@evergreen.edu wrote:
You should look at "My site was defaced("hacked"). Now what?" at:
Thank you. It looks like my template.tpl.php file was somehow tampered with. -- [ Drupal support list | http://lists.drupal.org/ ]
back when i was running 4.6 i did have hackers that not only wiped out my front page completely but "signed" the dirty deed in portuguese (they were from Sao Paulo, it seems).
so ... yeah .. it could be hackers too :)
Liza Sabater http://culturekitchen.com http://dailygotham.com http://lizasabater.com
On Tue, Aug 18, 2009 at 9:38 PM, Alexander Arul alexander.arul@gmail.comwrote:
A freelancer I once knew got a virus on his pc (sandbox). The virus editted *all* his .php, .htm .html files and added this kind of spam to them. He unknowingly uploaded the files to his host.
He had about 10 clients at that time, so you can imagine the mess and stress. He had to wipe his pc and go through all that code with a comb.
So the point of infiltration may be your pc/mac itself. Don't assume it's a hacker. I've been in web development for 3 years and never once encountered a malicious hacker *touch wood*.
The possibility of your host getting hacked exists, but it's a slim chance compared to a worm/virus on your machine.
Hope you fix it :)
Cheers Alex
On Wed, Aug 19, 2009 at 1:40 AM, george georgedamonkey@gmail.com wrote:
On Tue, Aug 18, 2009 at 12:36 PM, Metzler, Davidmetzlerd@evergreen.edu wrote:
You should look at "My site was defaced("hacked"). Now what?" at:
Thank you. It looks like my template.tpl.php file was somehow tampered with. -- [ Drupal support list | http://lists.drupal.org/ ]
-- [ Drupal support list | http://lists.drupal.org/ ]
So the point of infiltration may be your pc/mac itself. Don't assume it's a hacker. I've been in web development for 3 years and never once encountered a malicious hacker *touch wood*.
Stick with it a few more years. I have seen hostrocket's server's comprised more than once. I now steer clear of them.
F
-
Alexander Arul -
Fred Jones -
george -
liza -
Metzler, David