Please help ! ! !

This is unfortunatley out of my league so some kind of help would be greatly appeciated.

I have been with the same Hosting Provider for the last 7 to 8 years and never had any problems, no problems with the 80 sites that I host nor with contacting support when I needed it. They are a small company, but up until now have been brilliant.

The other day I noticed that some of the sites I look after were suddenly jumping way over their disk limit and bandwidth limit.

I decided to have a nose to see if the client was up to something on their website but no, it looked all perfectly normal until I started digging deeper and started finding obscene links to forums etc all in very deeply burried files.

It was clearly nothing to do with them as over the weekend another five sites have started having all the same symptoms............

Now, suddenly I can't get through my Hosting Provider who has previously suppled 24/7 support without any problems at all.

They are only an hour up the road, as I have now spent over 5 hours on their 0800 support number ! ! ! !

I keep deleting all these links and folders but they either just come back over night or jump onto another site.

I have changed all the passwords that I can think of!

All my sites are spread over several ip addresses but this appears to not matter a jot!.

Any suggestions? As there is no help from my provider at the moment, are they worth a visit?

Could be a server level hack. So no matter of changing passwords is going to help.

Do you have a standard control panel such as cPanel or Plesk? Moving might be an option with a migration wizard.

Edit: looks like they are all Plesk hosted from the control panel being on the standard port.

Matt

Edited by deleted (Mon 21-Sep-09 14:46:23)

They are all on Plesk, which is the only one I know how to run efficiently, at the moment, although I feel a change coming on.

With this many sites, anyone with any ideas about who would be good to migrate to, probably an oft answered question, but I am sure it won't hurt to be asked again as this is now getting silly.

Whoever is doing this I would guess either is school age or has a job, because it only happens out of normal working hours !

I presume you have scripting support on your server and run some scripts of some kind be it a CMS system or forum etc etc. The first thing I would do is have a look at where the files are being made and what are the permissions at that level.

I'm guessing you will be running on a linux machine of some kind and will have ssh access or even on windows hosting with remote desktop?

If so go to where the files are and look at who actually owns the files and what permissions they have. IIf they are root:root there isn't much you an do as it looks more like a server level hack. However if they are made with your account you can set the permissions on the directory where the files start to read only so then no files can be made in there as standard.

As people say it could be a server level hack in that case you cant really do anything as they probably have got more permissions than you have.

In reply to a post by Etchy:

If so go to where the files are and look at who actually owns the files and what permissions they have. IIf they are root:root there isn't much you an do as it looks more like a server level hack. However if they are made with your account you can set the permissions on the directory where the files start to read only so then no files can be made in there as standard.

And if the server isn't running some sort of user level security like suPHP, you may have files written by other users, (or even the web server) both of which you won't be able to delete if you don't own.

Matt

Edited by deleted (Mon 21-Sep-09 17:13:17)

Regardless of whether I have updated them or he/she has updated the files and directories, they still use the same username and group details, there is no difference, but at least they are not root !

All passwords have been changed, so it can't be somethng as simple as that

I am able to delete them, but as fast as I take them down on one site he/she is putting them up on another site, and they are sick, I will start checking permissions, but to be honest, it just looks like I have put them up there!

In reply to a post by TrevorSP:

They are all on Plesk, which is the only one I know how to run efficiently, at the moment, although I feel a change coming on.

With this many sites, anyone with any ideas about who would be good to migrate to, probably an oft answered question, but I am sure it won't hurt to be asked again as this is now getting silly.

Whoever is doing this I would guess either is school age or has a job, because it only happens out of normal working hours !

If you plan to change - and depending on how many sites, it may be worth going for a reseller or vps package, or finally move over to a dedicated server.

In reply to a post by TrevorSP:

Regardless of whether I have updated them or he/she has updated the files and directories, they still use the same username and group details, there is no difference, but at least they are not root !

All passwords have been changed, so it can't be somethng as simple as that

I am able to delete them, but as fast as I take them down on one site he/she is putting them up on another site, and they are sick, I will start checking permissions, but to be honest, it just looks like I have put them up there!

I would check for permissions, you can do this via ftp or ssh .. If it is root:root then there will be not alot that ucan do about it untill the host sorts it out.

There is sadly php scripts out their which have one touch access to ssh, and various buttons to do nasty things to a server.

None of them are root updated, thank goodness and the "Support Team" are now looking into it.

However, Tara is absolutely correct, it is time for a move, getting hold of this lot has become worse and worse over the years ! !

I have been with them seven years, through teething problems when they first started up and growing pains, but nothing like this, I suspect that Plesk has NOT got all the patches installed and that is why someone has managed to get in, but that is just my opinion after getting IMMEDIATE replies direct from PLESK themselves!

I am now thinking of moving over to Linux and cPanel. Would this be a sharp learning curve ???????? Anyone?

In reply to a post by TrevorSP:

None of them are root updated, thank goodness and the "Support Team" are now looking into it.

However, Tara is absolutely correct, it is time for a move, getting hold of this lot has become worse and worse over the years ! !

I have been with them seven years, through teething problems when they first started up and growing pains, but nothing like this, I suspect that Plesk has NOT got all the patches installed and that is why someone has managed to get in, but that is just my opinion after getting IMMEDIATE replies direct from PLESK themselves!

I am now thinking of moving over to Linux and cPanel. Would this be a sharp learning curve ???????? Anyone?

cpanel is pretty easy to use.

Demo at their website:
http://cpanel.net/products/cpanelwhm/try-demo.html

if you want to play with proper demo account I can set one up for you.. would be like 50mb space and 50mb tranfers for you play around with for a couple of days.

Not saying much more on that due to forum rules.

Oh meh name is Taras not Tara .. Not sure if i want to grow moobs .

have you got back ups of everything?

emails, databases, stats files?

Hi

Not least because they maybe went into their shell when there was a problem, moving is a good idea. You shouldn't have any issue with linux/cpanel, quite straightforward.

Just bear in mind that if the problem is on your sites, moving will not solve that. From your description, sounds like spam content but worth checking in case your site(s) are flagged as malicious. Various places but you could start with Google Just change the URL after the = sign to yours.

If the sites are flagged, you will need to file a request for a malware scan via Webmaster Tools after the site is clean and secure. Should the situation be just content spam and this is indexed, best to file a Request for Reconsideration after you clean up.

Can't recommend anyone in particular for the move, although a reseller package at Heart would probably be okay and reasonably economical.

To answer your question first Algorythm, yup, all of it!
I learnt as early as 1976 the value of a correct and functional backup system that is tested regularly

You are so right to mention that now and just jog everyone's memory, Does it work! ! ! !

Ansolan,

Yup, already a member of Googles Webmaster Tools and will do it before the 30 days is up. Providing I am all moved and settled in by then ! ! ! ! Only one site has been flagged by Google at the moment, luckilly, one of our "play" ones, so no harm done, but if they have found one, they will find the others quite soon I should think

I do have someone in mind for my package thank you, but there is never any harm at looking at one more So thanks for your advice

Oh, and just for everyones interest, the Hoster that I have been with for over 7 years and have seen grow from virtually nothing to something quite large, STILL have not actually replied to any of my emails, they have ACKNOWLEDGED THEM, but not actually done anything that I can see to help, so leaving them should be fun!

Total so far on their support phone trying to get passed their "Your call is important to us, please wait while we answer your call", is a staggering 17hrs, longest single call being 3 hours 50 minutes,! Thank God for speaker phones !

Luckilly they are less than an hour away by car, so a visit maybe in order ! ! !

In reply to a post by TrevorSP:

Oh, and just for everyones interest, the Hoster that I have been with for over 7 years and have seen grow from virtually nothing to something quite large, STILL have not actually replied to any of my emails, they have ACKNOWLEDGED THEM, but not actually done anything that I can see to help, so leaving them should be fun!

Sounds as if, as thy have grown that they have forgotten to make sure support is grown too. Something that seem to happen to a lot of businesses and is often over looked..

The other reason for possibly ignoring the calls that they know of the problem and do not know how to solve it. But holding their hands up now would be a good idea.

We all have mess ups in business and dealing with them is what makes the business good or bad. But as we do not know the situation one couldn't concur that they know of the situation.

I am angry today. They still haven't replied, but they obviously have mega problems, as they have downgraded my support ticket from URGENT to NORMAL ! ! ! !

They still haven't bothered to even email me, let alone contact me on our 0800 number or anything! So that tells me that they have some very serious problems up there ! ! !

I agree with you Taras, if you have a problem, own up and you will be praised for it, certainly you will get a better customer repsonse than trying to hide.............

Edited by TrevorSP (Thu 24-Sep-09 14:46:51)

In reply to a post by TrevorSP:

I am angry today. They still haven't replied, but they obviously have mega problems, as they have downgraded my support ticket from URGENT to NORMAL ! ! ! !

They still haven't bothered to even email me, let alone contact me on our 0800 number or anything! So that tells me that they have some very serious problems up there ! ! !

I agree with you Taras, if you have a problem, own up and you will be praised for it, certainly you will get a better customer repsonse than trying to hide.............

Assuming its the same provider as the one whats providing the site on your link. there seems to be no indication of issues at the moment - last one was april.

It is that provider, if you are doing an IP lookup and not just reading the bottom of the page which is our company details !!!! Hosted by Stapleton&Price etc is us ! ! ! !
The company in question used to be very very good.............

No idea what is going on, but something is, and they are keeping it very close to their chest. They have bought out at least three companies in the last few years to add to their userbase, that I know of, rightly or wrongly, but there does seem to have been a lot of activity on their records at company house, so I will download their main reports tomorrow, make sure I am going to the right addresses. The owners home is about 3 miles away from the Company address, so I am heading off in the right direction............

If they won't even answer my support tickets or email, then I think I need to knock on some doors to make sure they are still there and trading!

Edited by TrevorSP (Thu 24-Sep-09 20:24:30)

In reply to a post by TrevorSP:

It is that provider, if you are doing an IP lookup and not just reading the bottom of the page which is our company details !!!! Hosted by Stapleton&Price etc is us ! ! ! !
The company in question used to be very very good.............

No idea what is going on, but something is, and they are keeping it very close to their chest. They have bought out at least three companies in the last few years to add to their userbase, that I know of, rightly or wrongly, but there does seem to have been a lot of activity on their records at company house, so I will download their main reports tomorrow, make sure I am going to the right addresses. The owners home is about 3 miles away from the Company address, so I am heading off in the right direction............

If they won't even answer my support tickets or email, then I think I need to knock on some doors to make sure they are still there and trading!

yeah i did a ip look up to find the ip block and the company begin with P.

Correctimundo !!!!!!!!!!!!!!!!

In reply to a post by TrevorSP:

Correctimundo !!!!!!!!!!!!!!!!

I did have a look around the net to see if theres been any other issues with the company and could seem to find any.

You should read their company reports for the last three years, talk about a stone dropping ! ! ! ! In my personal opinion of course !

In reply to a post by TrevorSP:

You should read their company reports for the last three years, talk about a stone dropping ! ! ! ! In my personal opinion of course !

Oh dear. My main concern is that that your not having any joy after nearly a week.

Are you paying monthly or annually?

Paid up 'till end of March next year, however, that will come back through the small claims court if required.

There is a largish update after today, but I am shattered, so I will post again tomorrow with my findings after roaming all around Brentwood in Essex from address to address !!! Thank God for TomTom ! ! ! !

Eek. I'd say if you've not got a recent backup, to take one as soon as you can - just in case.

Matt

Oh dear how many accounts did you have with them

Only about 80 a/s, so not nearly as bad as some of my friends!

However, it would appear that there have been some genuine misunderstandings and that things are about to change. This has however, not changed my mind that I need to change companies within the next month at the latest.

Firstly I went roand to their office, the address I got from their website, and although I could see staff in there, there was some notices saying, "CUSTOMERS, please email our offices, we do not allow visitors for security purposes"

I found a letter box and dropped off my letter of complaint anyway, I had three copies, so I had to get rid of at least one !

Not to be deterred, after that mornings check with Companies House, I went round to the companies registered Office, the two main directors (Husband and Wife) house! Very nice house and very nice people, just happen to be on holiday at the same time ripping out their old kitchen or something.

However, it was their registered office with CH so I had a right to be there during office hours if nothing else but to ask to see their "Record of Members" Books and their latest public company accounts, although I already had them in my hand from the checks I did in the morning.

They were incredibly surprised to see me there and the guy was built like a brick house and towered over me. I went into complaint mode and read my letter out to him after giving him a copy to follow, along with several "Encs" the guys face litterally changed colour before my eyes, to white !!!

He agreed with everything I said and with the way that I had gone about it too, because of the mail strike you understand.

This is what he said, in a very summed up nutshell.

It was very unusual for him or his wife not to be in the office, this is the first break they have had since the last takeover about two years ago and they had "Trusted" the staff to "get on with it" whilst they were away.

He said he was very shocked and dismayed at the way I had been treated and would look into it on Sunday and write me a full report and what they would do to rectify it my mid day monday.

SOoooooooooooooooooooo. I await mid day Monday to see what transpires. They offer and do have 24/7/365 support, so I guess he will be in there today or tomorrow to find out what has been going on for the last two weeks whilst they have been away.........

Maybe it is a case of "Whilst the cats away" but we shall wait and see.

I fully intend to move the most important sites to a new host next week and I also intend to bring the remaining ones over before my yearly contract expires with them at the end of March next year.

I am kind of thinking that a change is as good as a rest and I fancy a company that actually answers the phone whilst the boss is out!!!!

It is funny really, I have been staying with them out of loyalty for a long time, for ages in fact and it was only this last week or so when I started looking around that I found some excellent companies out there with decent track records too of over five years that I would consider because they offer much more for much less ! ! !

So in the end, no matter what the outcome of this little spat, I think a change is in order, some immediately and some before the end of the contract whcih gives me a lot of time to plan and move one by one and not in a mad dash and let mistakes creep in ! ! !

We have full backups of all our a/c's including mail etc.
We take and CHECK them weekly during a Sunday Morning starting at around 3am and ending about 5 I think, haven't checked the exact times for a long time, I just know that should the worst happen, they work ! ! ! !

We have two very important ones that change hourly during a working week and they are continually backed up as you would expect.......

Well, believe it or not, this started affecting us on 17th September and here we are now in November, with the situation worse than it was.

Just to let you know what has happened. I got sick of waiting on hold for customer support, some of it over 3 hours or more! I couldn't get a reply to emails and none of their Ticketing system was ever producing a reply either.

I went to Companies House on line and downloaded their last three years accounts and the names and addresses of their directors etc. Cost less than a tenner for everything that I wanted.

The first thing that I noted was that their profits that they were enjoying a couple of years ago, look like they are now non existant, in my own personal opinion of course and from my own interpretation of their filed and public accounts!

Anyway, I drove down to the "New" Registered office to see someone and found myself at a not so ordinary House, rather run down actually, in my personal opnion and found the Director, who was currently ripping out his kitchen and making way for a new one or something!

I gave him the letter that I had taken with me and then we discussed it. He basically blamed it all on his absence during his holiday, but promised to look into the next day regardless.

I asked how I was going to contect him to get the results and to discuss it further with him and he said "Don't worry, I will ring you". He has as of now, never rung either our work, house or mobile numbers.

Has anything been done, from where I sit, I would say NO ! ! ! Unless you count just more promises to sort it and that they take security very seriously.

Meanwhile three of my sites were infected again. I cleaned them up and they are now waiting for Google to check them before they will put them back on their search engine. However, I have found Google Webmaster tools very informative.

When all this started, they only had about a dozen or so sites infected on their server, now as of today they have 130. The google report is below if you are interested.

The company are adament that it is something on our workstations, presumably meaning that all 130 website hosters have the same virus/trojan on the PC's that they use to upload to their servers.

Needless to say as soon as he said that, we went overboard and scanned everything that moved or didn't move in the house and even wormed the dogs, but found absolutely nothing, so I have asked him what we should be looking out for, what kind of trojan,worm or virus, as he is so sure it is client based and he has yet to reply, as normal!

I would be obliged if someone would take a look at the two Google reports below to see what they make of them..............
The first shows our now clean website, the second is a report on their server and if anyone can shed any light on what "Client side malware" could do this I would dearly love to know!

----------------------------------------
Google Report One on our website that was infected

Safe Browsing
Diagnostic page for manorhousephotos.co.uk
What is the current listing status for manorhousephotos.co.uk?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 6 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 3 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-10-24, and the last time suspicious content was found on this site was on 2009-10-24.
Malicious software is hosted on 8 domain(s), including search-box.in/, plcscanner.com/, safetysecurityplus.com/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including search-box.in/.

This site was hosted on 1 network(s) including AS35591 (PROVIDERONE).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, manorhousephotos.co.uk did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

----------------------------------------
Google Report Two on one of their servers

Safe Browsing
Diagnostic page for AS35591 (PROVIDERONE)
What happened when Google visited sites hosted on this network?

Of the 301 site(s) we tested on this network over the past 90 days, 131 site(s), including, for example, chs-ltd.co.uk/, trades-directory.com/, sailing-by-st-ives.com/, served content that resulted in malicious software being downloaded and installed without user consent.

The last time Google tested a site on this network was on 2009-11-04, and the last time suspicious content was found was on 2009-11-04.

Has this network hosted sites acting as intermediaries for further malware distribution?

Over the past 90 days, we found 3 site(s) on this network, including, for example, scruntlehawk.com/, wilsoncentre.com/, worcesterdaynursery.co.uk/, that appeared to function as intermediaries for the infection of 3 other site(s) including, for example, marbellabam.com/, daynurseries.co.uk/, the-arena.co.uk/.

Has this network hosted sites that have distributed malware?

Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 3 site(s), including, for example, scruntlehawk.com/, wilsoncentre.com/, worcesterdaynursery.co.uk/, that infected 3 other site(s), including, for example, marbellabam.com/, daynurseries.co.uk/, the-arena.co.uk/.

Next steps:

Return to the previous page.

----------------------------------------

H E L P

Does this make sense to anyone at all !!!!

Sounds like the server has been hit by a malware attack.

Have you looked at your code for Javascript that you've not put there? also check your file times to see when they were updated.

Matt

Done all that Matt, our sites are definately clear now, unless I missed something, which I am sure we didn't because we got very very used to what we were looking for a getting rid of it! After you have done a dozen sites the other 30 odd are dead easy................... !

Google will automatically lift the page warning after a few days..

You can speed this up by requesting it via Google webmaster tools.

https://www.google.com/webmasters/tools/home?hl=en

Matt

With regard to the file times, if my memory serves me right our first file index.html was changed on 19th September 2009, it is this and the huge increase in the size of the file that first allerted us. Although it looked like we had done it using our username and passwords.

We immediately changed all our passwords for what Microsoft term as "BEST"

Although sites were still got at!

Done that too thanks Matt, although when the pages are updated again, then we go through the whole process.

One that is clean at the moment, basically because I removed everything bar the front page is our personal one www.sodburyhouse.com
This currently shows clear on Google, but give it a couple of days .........................

In reply to a post by TrevorSP:

Although sites were still got at!

If another site on the same server is exploitable - all your sites could be affected. Changing your password will be useless.

Ultimately, you might be better off moving hosts to one that runs slightly better per-user protection helping stop this kind of thing.

Of course, this is purely assumption.. but having been offering hosting for over 6 years - we've seen it all!

Matt

In reply to a post by TrevorSP:

I would be obliged if someone would take a look at the two Google reports below to see what they make of them..............
The first shows our now clean website, the second is a report on their server and if anyone can shed any light on what "Client side malware" could do this I would dearly love to know!

----------------------------------------
Google Report One on our website that was infected



----------------------------------------

H E L P

Does this make sense to anyone at all !!!!

Have you at hand either .. a copy of the infected site or webpage or a link to a live working one. ?

Should be able to pick one out of the dark and at random......................

Hang on a tad...............

Nothing to do with us, except that it shares our server, all our sites should be 100% clean now! No thanks to the we are well known for our award-winning service and 24x7 live technical support. After more than 7 years in the web hosting industry, we know that our customers are the most important part of our business. With Provider-one.net you can rest assured that you are getting the best overall web hosting value - supported by the best, most experienced people in the industry.

77.75.194.25
www.whynotjewellery.co.uk/

Here is a Goody in all it's glory, you only have to look at the source from the front page, if you could see deeper into the inside of the web site, you would see several folders all called random five letter groups of the alphabet like, abcde or jhfdy etc. In those folders there are usually hundreds of html, htm or php pages that have links to all sorts of disgusting stuff ! ! !

Edited by TrevorSP (Wed 04-Nov-09 20:09:19)

Looking at that site, I can't see anywhere that they might be inserting code, so as has been said before, the main server must have been hacked/root access gained. I would suggest moving you sites away from there asap, then taking legal proceedings against your current hosts for breach of contract.

In reply to a post by metalhead41:

Looking at that site, I can't see anywhere that they might be inserting code, so as has been said before, the main server must have been hacked/root access gained. I would suggest moving you sites away from there asap, then taking legal proceedings against your current hosts for breach of contract.

The site is using zencart and with any of the shelf carts you end up with one or more folder 0777. therefor file injection can occour. That would be a client side site hack.

on the main index page

"<u style="display:none;"><a href="http://veteransadv..."

Cropped the url for security reasons but on one of the reoccurring site links I had a look at had a url pointing to

lang/deutsch/tfslc/

and

lang/deutsch/akhfm/

Again typically lang would be set to 0777. thus allowing spammers to add and choose what files to add. Some of the links in one of the pages go to an usa college/uni. The spider web continues.

The two issues i have at the moment is this.

Either the public_html folder was left at 0777 or the index.php was 0777.. So potentially if this was a single case - password compromised or a mishap by the webdesign company.

But based on what Trevor has said that his and other sites have had the same thing done it means the server is compromised either by root access or some malicious files in /tmp

Update:

The index.php has around 300 links to other sites that then link to other sites to keep up the spiderweb of keeping spam links open......

Edited by Taras (Wed 04-Nov-09 22:11:56)

From a hosting prospective

At the end of the day this can and does happen on accounts on servers. We have seen this [censored] happen ourselves. Quite often its an issue with a security breach of the software being installed by clients.

That said Premier one has failed their clients by not looking into this and watching bandwidth usage on accounts. not checking temp directories. nor making sure insecurities in server software are addressed. Or to make any attempts to regain control of their infected server or servers (should have changed root password in the first instance)

Premier one should have announced in some way that users should check if they are leaving security holes and or update their php scripts.

That is basically their failings ..

I swear on whatever God you believe in that I will never move a domain to a hosting provider where I can not unlock it and order my own EPP keys ever again ! ! ! ! EVER

All sorted now, but look at the start date of this thread to get some idea about how long it has taken with virtually every day trying to contact a (IMHO) non existant support department! ! ! ! !

Just to give you an idea, this site http://www.whynotjewellery.co.uk/ was infected way before any of mine, and what have the hosting company done? Take a look at the source code for yourselves, it is quite safe if you don't mind the language or click on any links!!!!

Edited by TrevorSP (Wed 02-Dec-09 12:05:25)

Oh, Trevor its crazy how long this has been going on AND that sites on those hosts are still infected!

Are you saying that the Host's solution to the hack is putting the "no display" Div around the link farm? I'm assuming so as the hackers would not benefit from the links being hidden, unless they are claiming fees for linking rather than click-throughs. Which seems very unlikely. I also see they are there and hidden on every page on the site. Its putting some interesting references in the CACHE of every visitor though isn't it.

Most (all?) of the ruder links are carrying a Refer Tag (w-a-t-c-h-i-t without the hyphens) which is how the hacker(s) would earn their money on click throughs. It might be worth complaining to the rude site about hacking that is carrying that Refer Tag. If they did cut off the referer's income at source it might discourage such attacks.

In reply to a post by KevinR:

Oh, Trevor its crazy how long this has been going on AND that sites on those hosts are still infected!

Are you saying that the Host's solution to the hack is putting the "no display" Div around the link farm? I'm assuming so as the hackers would not benefit from the links being hidden, unless they are claiming fees for linking rather than click-throughs. Which seems very unlikely. I also see they are there and hidden on every page on the site. Its putting some interesting references in the CACHE of every visitor though isn't it.

Most (all?) of the ruder links are carrying a Refer Tag (w-a-t-c-h-i-t without the hyphens) which is how the hacker(s) would earn their money on click throughs. It might be worth complaining to the rude site about hacking that is carrying that Refer Tag. If they did cut off the referer's income at source it might discourage such attacks.

its circular chained .. - it goes off to another site when is then linked to another infected site.. this is rwhy suPHP and 0777 on linux host must be put on and in the case 0777 banned

I'd bet the script that compromised the sites put the div there. So when the owner goes to the site, they think none the wiser.

But Google/Bing/Yahoo WILL see it regardless of the div status and then might create reciprocal links from/to the sites shown, spreading out the 'link juice'.

Matt

So you mean the link will increase the search ranking of the targeted sites?

I was especially intrigued that the adult links are formed as normal refer links - that implies the hack could be tracked to a refer registered with the target. And those links make less sense to me if people cannot actually click on them. They go to one of the larger real adult sites unlike the other dodgy looking blogs, and pharmaceuticals, etc. Those unusual links could certainly help the ranking of the dodgy sites.

If the 'rank' of the previous page is good, yes, certainly possible.

The idea of this 'hack' isn't for people to be able to click on them, but to build the credibility of the target sites by having them linked from 'normal', good, clean sites.

However, it can also work in reverse.. but instead damage the reputation of the referring site by linking to a 'bad' neighbourhood.

Matt

I don;t think that happens with google?
Google banned one of my sites, www.manorhousephotos.co.uk from the search engine until I had corrected it and then I have to wait 90 days whilst they check it and THEN if it is clear after 90 days they will unblock it !!!! a bit harsh, but customers protected.

The other search engines don't seem to care a jot !

I hasten to point out that the above JEWELERY site is nothing to do with me, just on the same server as I USED TO BE ! ! ! !

Edited by TrevorSP (Thu 03-Dec-09 09:31:01)

Trevor,

You can speed that process up.. by using Google Webmaster tools

Matt

All done and dusted and all clean as a whistle now Matt, thanks, much faster, much more secure and with a company that I trust, that even has humans on the end of the phone ! ! !

I think pretty much all of the sites have been put back on Google now, bar a couple of dormant ones which I want to pull down and put back up in a different way, but easy as pie to do now, no more having to ask support to do simple jobs for me now, I can just get on and do it ! ! ! Brilliant Stuff!

And moving from Plesk to cPanel was actually no great shakes at all, some things are just named differently that is all, basically. What really helps though are the help panels and videos that go with it all, make it all as easy as pie

Which reminds me a need an IP addy and SSL but that can wait until next week now, can't be bothered with this week, too much to do still ! ! Might even be next year the way things are going at the moment......... Why do people always leave it until just before the Christmas holidays to ask for things that need doing ! ! ! !

Edited by TrevorSP (Thu 03-Dec-09 15:49:41)

In reply to a post by TrevorSP:

Why do people always leave it until just before the Christmas holidays to ask for things that need doing ! ! ! !

What do you mean just! - there is at least 2 and a bit weeks to go, they often manage to hold on to pm on the 24th