FlyerTalk Forums

FlyerTalk Forums (https://www.flyertalk.com/forum/index.php)
-   Travel Technology (https://www.flyertalk.com/forum/travel-technology-169/)
-   -   My website was hacked! (https://www.flyertalk.com/forum/travel-technology/682880-my-website-hacked.html)

Harrald Apr 19, 2007 7:10 am

Looks like a new set of of addresses have benn added to your site. This time hidden at the top. Dr-Tom looks to be off the hook for now

PTravel Apr 19, 2007 9:09 am

I was on the road yesterday. Today I'm getting a new webhost.

Arrggghh!!!!!

Efrem Apr 19, 2007 11:55 am

Looked clean just now. Hope it stays that way!

BTW, loved the Harbin Winter Festival video. Not to hijack the thread or get too far off-topic, but who is the young woman in the white down jacket and black leather hat who shows up so often?

PTravel Apr 19, 2007 1:22 pm


Originally Posted by Efrem (Post 7607944)
Looked clean just now. Hope it stays that way!

I hope so, but I'm going to switch web hosts. Unfortunately, the timing is bad as I have a lot on my plate just now. I've been checking the site twice a day and, more often than not, I'm finding it hacked (though at least now they're just going after my index page).


BTW, loved the Harbin Winter Festival video. Not to hijack the thread or get too far off-topic, but who is the young woman in the white down jacket and black leather hat who shows up so often?
Thanks! That's Mrs. PTravel, who also "stars" in the Buenos Aires video (and is the "Xi" in "He & Xi Productions" which, by the way, is nothing more than an affectation -- this is strictly a hobby for me and I have no professional or commercial asperations). She doesn't like being in front of the camera, and it's always a struggle when we travel -- I usually have to get tricky to get shots of her. She's also less than thrilled that I've put her image all over the internet for the world to see, though she does insist on final cut approval before I put the videos up on the website. She will be thrilled, however, that you referred to her as a "young woman." She does look a lot younger than her actual age -- I'm a lucky man! :)

PTravel Apr 22, 2007 1:53 pm

Just a follow-up . . .

Despite repeated trouble tickets to my web host (MySiteSpace.com), my site was hacked daily for a week. The first trouble tickets resulted in stupid responses -- "change your access password" (I did several times, but the problem was on their end, not mine), "we're installing new security software, give it a day" (I did, one week later I was still getting hacked), etc. Finally my tickets were just ignored.

Special thanks to ScottC, who pm'd me with a recommendation for a reliable web host -- I switched last night. The new host (Dreamhost.com -- why not give them a plug?) appears to be secure, reliable, faster and gives me more storage for just a little more money than those morons at MySiteSpace.

A couple of cautions if you have a website:

- ALWAYS keep a clean copy of every file on the site. I do that, which made repairing the hacked site and moving my web site to the new web host very easy -- I just ftp'd everything back up and was up and running in the amount of time it took to complete the file transfers (about an hour).

- I had downloaded the hacked index page to take a look at it in FrontPage. Then I did something very, very, very stupid. I opened the page in my web browser to see what it looked like. Perhaps because it was a local file, none of my anti-malware or anti-virus software kicked in. It contained javascript that, I'm pretty sure, installed a root kit virus; at any rate, I started experiencing serious slowdowns and crashes on my machine. I spent the better part of yesterday getting the damn thing out. Microsoft has links to some tools that help -- one is a program that tries to detect files and links hidden from the Windows API, i.e. rootkits. It found some suspicious code and links hidden in the registry. The other was a cleaner that removes registry entries that contain nulls (also used to hide root kits). Fortunately for me, the executable virus code was hidden in subfolders under temp directories so I simply removed the entire temp directory (and lost a bunch of cookies that I wanted to keep in the process, e.g. passwords, etc.), removed the null entries from the registry, removed entire key sections from the registry that I decided didn't belong, and rebooted. Everything seems back to normal, but this kind of open-registry surgery and wholesale deletion of system subfolders is not for the faint-of-heart, and I wouldn't recommend doing it unless you have a pretty good idea of how the OS works. At any rate, I digress -- hacking websites is serious business. If yours gets hacked DO NOT play with the hacked page unless you know EXACTLY what you are doing. Most of the time, the hacks are innocuous -- links inserted to boost their google scores. Sometimes, however, they're not.

- Don't pick a webhost based solely on price. If I wasn't reasonably organized on my end, I could have a lost website content that's taken me years to develop.

- You can trust ScottC's recommendations! :)

sandiegofun Apr 23, 2007 10:43 am


Originally Posted by PTravel (Post 7622464)
Then I did something very, very, very stupid.

I stupidly clicked on one of the earlier links to your host, which opened a file tree in IE, and then continued with my stupidity by clicking on one of the folders which tried to install something. Our scanners at work picked it up, scanned my laptop for an eternity, then our porn blocker added your site as a block due to 'malicious content'... Sometimes my brain fires backwards..

Emma65 Apr 23, 2007 1:49 pm


Originally Posted by sandiegofun (Post 7626634)
I stupidly clicked on one of the earlier links to your host, which opened a file tree in IE, and then continued with my stupidity by clicking on one of the folders which tried to install something. Our scanners at work picked it up, scanned my laptop for an eternity, then our porn blocker added your site as a block due to 'malicious content'... Sometimes my brain fires backwards..

I did a classic one 5 years ago. Installed my PC laptop with a full win2k server install. Me thinking "I know what I'm doing. I work at an ISP." (I did back then) stupidly did not install antivirus and firewall. Flew to Luxemburg to deliver a site, went on line from there and within seconds all the sites that were in development on my laptop were infected by that effing virus that attacked win2k servers and spread via html pages. I spent 10 minutes trying to fix it only to realise it was an impossible task, closed the lid, flew home and had to start all over again.

Since then I always travel with install disks and backups of my content on external HDD or CD/DVD despite the fact I'm now a mac user.

Can't be too cuatious these days.


All times are GMT -6. The time now is 6:58 pm.


This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2026 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.