Would you know?

The other day I went to my own site (http://AreWeConnected.com) using the Google Chrome Browser.  The page would load and just as it finished loading it would switch to Google.  Curious, I tried it on Firefox, and Safari, and Internet Explorer and a few others.  It was only Chrome and only my site.

I mentioned this on Facebook and one of my friends (Mark Elster of http://eye580.com/) suggested I remove the iframe after the tag.

That’s funny (thought I), why would there be an iframe after the end of the html file?  I wouldn’t be that dumb.  So I looked at my source code (view-source:http://areweconnected.com/) and sure enough, all the way at the very very bottom was a little itty bitty iframe!

Just like this:

iframe

Tricky little bastards!  Did you see that the frame is 0 x 0?  I did a quick Google search and found out that it could be a malicious malware that might infect a whole server!

Now that I was on the alert I did the following…

  1. Made sure my antivirus was up, and updated.
  2. Ran a full scan of my hard drive with AdAware (also updated)
  3. Ran a full scan of my hard drive with SpyBot Search and Destroy (yup, updated)

With everything coming back clean on my hard drive.  I then changed all my passwords (Wordpress, cPanel, FTP), double checked that all my file permissions are safe.

wpscan

The fix for this particular issue is to manually remove the offending iframe from the end of every index file.  Did you know you have more than just 1?  Once that was done – everything scanned and worked fine.

and then… my whole SERVER went down!

It was not my fault and I hope not related, but the entire server where AreWeConnected.com is hosted went dark!  While we were waiting for them to fix it, there was a little discussion on their forum.  I shared my issue with others and incredibly they too had the very same issue!  See:http://www.totalchoicehosting.com/forums/index.php?showtopic=39850&pid=243022&st=0entry243022

Coincidence? 

I really can’t say.  But I suggest right now you do the simple check.  Go to your website or blog, “view source”, scroll to the very bottom and make sure you don’t have an iframe (or two) at the bottom!  If you do – let us all know and I’ll help you get rid of it.  If you don’t know how to check – just give me the link to your site, it’ll take me 2 seconds to check.

BTW: Of course my site is backed up (automatically once a week) it sends a zipped file to a gmail address.  Do you have automatic backup?

 

 

This post brought to you courtesy of Mike Mueller.
Feel free to ReBlog or ReTweet as you like as long as you credit the source (him).
Did you know?  He's for hire! He builds Blogs, Graphic Images and Widgets and Facebook Pages and besides… He knows lots of really cool stuff.

Hire Mike (925) 456-4567

Twitter Facebook Foursquare LinkedIn Blog Flickr YouTube Email

 Sample Facebook Pages:
View on Flickr

Sponsored Links: (check these guys out!)


RealBird does some great things!      Mike says the Thesis theme ROCKS!      

Did you know?

 
Post is included in group: Real Estate Technology
Post is included in group: Realtors®

88 Comments on Has your Site been HACKED?

20 Most Recent Comments Displayed Show All

JUN
17
2010
455,129 Points 10 Featured Posts Outside Blog Called Shot Master

Mike, I'm fairly certain it's full access, but how can I check?
2:55pm • #69
1,028,818 Points 16 Featured Posts Localism Sponsor Outside Blog Called Shot Master

Thanks for the comments Mike.  There are a lot of issues out there we cannot keep track of.
3:04pm • #70
303,822 Points 67 Featured Posts Outside Blog

Wayne - 

Sorry busy working...  If you have cPanel access you can usually go to see the various ftp accounts that are setup and what the values there are.
4:09pm • #71
303,822 Points 67 Featured Posts Outside Blog

Gene - "There are a lot of issues out there we cannot keep track of"  Not when you have a newborn in your hands!  Congrats!
4:49pm • #72
708,855 Points 39 Featured Posts Outside Blog Called Shot Master

I guess I will have to check, thanks for the heads up.
6:13pm • #73
455,129 Points 10 Featured Posts Outside Blog Called Shot Master

Nah, I'm hosted on GoDaddy, so no cPanel. I logged in and it appears I have full access, but GD is notoriously more difficult to use and decipher than, say, HostGator or BlueHost.
6:17pm • #74
303,822 Points 67 Featured Posts Outside Blog

Wayne - I'm totally in love with BlueHost right now.  So much so, I added it to the bottom of my posts!
6:48pm • #75
455,129 Points 10 Featured Posts Outside Blog Called Shot Master

Yes, I've heard they're good, I just followed your link and took a look at them...sounds like a nice set-up, I'll have to keep them in mind for when I transfer my WP blog off of GD!
7:13pm • #76

About five years ago, one night odd things started happening, using IE. Every time I would go to IE, the browser url would change to something else (I forget what). Porn started appearing and little screens saying 'installing .exe - whatevers' - I had no clue what was happening and my regular longtime tech had no clue either at that time. Nothing worked. Finally had to call in virus specialist. He was at my machine for a full day, with cables and his own disks. I could have/should have perhaps just bought new computer. But mine was only a few months old.

Long story short it cost me about $2300 to get the problem fixed. Browser was hi-jacked. Had to rebuild from scratch, reload all programs; total nightmare. I always thought it had something to do with Norton. Using OE email, with (then) Norton scanning for protection.

Each year for several years (I have since removed Norton entirely) as expiration date approached I would start having virus issues. Odd in recent years since I stopped using Norton, never had an issue of any kind.

People should take your post very seriously. Nothing can be taken forgranted once you are aware of the issue involved. Get expert help immediately. It won't go away on its own and unless you know what you are doing entirely, you could make matters worse. Whatever you do, don't do a backup once that mess has inhabited your computer. You will simply be backing up the problem and destroying any other backup you may have.
7:14pm • #77
303,822 Points 67 Featured Posts Outside Blog

Wayne - I just worked on transferring a blog from GD to BH.  Backed everything up - created the new site and mirrored the posts, images, etc.  a few more tweaks and he'll change the DNS and make the site live.

Carolyne - what a tale of woe!  Sorry that happened to you.
7:19pm • #78
886,497 Points 47 Featured Posts Localism Sponsor Attended Rain Camp Called Shot Master

Mike, I think there was an all out attack on a lot of sites last week. One of our outside blogs went down, our email wasn't working, my credit card wouldn't work for an online purchase, but then worked 30 minutes later at the grocery store.
8:59pm • #79
818,052 Points 7 Featured Posts Outside Blog Called Shot Master

This is all very disturbing.  I checked my site and it's OK for now.  I do get the creeps from FB sometimes and try not to click on things from people there.
10:16pm • #80
154,676 Points 10 Featured Posts

WHEW!  Thanks, Mike.  My husband's site was hacked a while back and it kept going down page by page...  we found a single pixle (1 tiny, itsy-bitsy black dot) on his site that had a link to the hackers.  CRAZY!
10:59pm • #81
303,822 Points 67 Featured Posts Outside Blog

Connie - you still have a code error somewhere that you'll want to fix.
11:04pm • #82
JUN
18
2010
270,270 Points

Thanks for sharing - this is some very good info - Have a great day!
7:28am • #83
1 Featured Post

Thanks Mike for the heads up!
7:32am • #84
259,783 Points 1 Featured Post

Mike, Can you check my site without being on the admin side?  If so, I would love for you to check it for me: www.buywilliamsburghomes.com

Thanks in advance!
12:49pm • #85
JUN
19
2010
303,822 Points 67 Featured Posts Outside Blog

Sybil - You are clean but...

What's with the crazy empty tables at the bottom?
2:11pm • #86
JUN
27
2010
117,186 Points 4 Featured Posts

good info. not sure how to find my soure code, but good info.
5:17am • #87
JUN
30
2010
183,160 Points 1 Featured Post Attended Rain Camp

Hi Mike, Thanks for the heads up on this"virus"

 
12:50am • #88

20 Most Recent Comments Displayed Show All

Login or register to leave a comment
 
Mike Mueller (Tech and Social Media Consultant) Rainmaker_large

Mike Mueller

Walnut Creek, CA

More about me…

Tech and Social Media Consultant

Email Me

Technology for Humans


Mike@AreWeConnected.com
(925) 456-4567

Twitter Facebook Foursquare LinkedIn
Blog Flickr YouTube Email

DO SOMETHING

Skip Something. Feed a child.

One Warm Coat

Every Kid needs a bicycle

Click to Order
FREE Samples

RealBird

are you following me? Are We Friends Yet? It's not just a Rolodex You've got to see this... Feed Your Reader
Like the Site? Tweet It!

Did you know this site is available on the kindle?
Get this on your kindle!
(Click on image)

Honored to be
Featured in Alltop


Mike Mueller on Facebook




Listings

Links

Archives

RSS 2.0 Feed for this blog