Go Back  FlyerTalk Forums > Travel&Dining > Travel Technology
Reload this Page >

My website was hacked!

Community
Wiki Posts
Search

My website was hacked!

Thread Tools
 
Search this Thread
 
Old Apr 19, 2007 | 7:10 am
  #31  
 
Join Date: Feb 2006
Location: EWR
Programs: Marriott Silver
Posts: 98
Looks like a new set of of addresses have benn added to your site. This time hidden at the top. Dr-Tom looks to be off the hook for now
Harrald is offline  
Old Apr 19, 2007 | 9:09 am
  #32  
Original Poster
FlyerTalk Evangelist
 
Join Date: Mar 2004
Location: Newport Beach, California, USA
Posts: 36,062
I was on the road yesterday. Today I'm getting a new webhost.

Arrggghh!!!!!
PTravel is offline  
Old Apr 19, 2007 | 11:55 am
  #33  
FlyerTalk Evangelist
40 Countries Visited
3M
All eyes on you!
25 Years on Site
 
Join Date: May 1998
Location: Massachusetts, USA; AA 2.996MM & Plat Pro, DL 1MM, GM & Flying Colonel
Posts: 25,037
Looked clean just now. Hope it stays that way!

BTW, loved the Harbin Winter Festival video. Not to hijack the thread or get too far off-topic, but who is the young woman in the white down jacket and black leather hat who shows up so often?
Efrem is offline  
Old Apr 19, 2007 | 1:22 pm
  #34  
Original Poster
FlyerTalk Evangelist
 
Join Date: Mar 2004
Location: Newport Beach, California, USA
Posts: 36,062
Originally Posted by Efrem
Looked clean just now. Hope it stays that way!
I hope so, but I'm going to switch web hosts. Unfortunately, the timing is bad as I have a lot on my plate just now. I've been checking the site twice a day and, more often than not, I'm finding it hacked (though at least now they're just going after my index page).

BTW, loved the Harbin Winter Festival video. Not to hijack the thread or get too far off-topic, but who is the young woman in the white down jacket and black leather hat who shows up so often?
Thanks! That's Mrs. PTravel, who also "stars" in the Buenos Aires video (and is the "Xi" in "He & Xi Productions" which, by the way, is nothing more than an affectation -- this is strictly a hobby for me and I have no professional or commercial asperations). She doesn't like being in front of the camera, and it's always a struggle when we travel -- I usually have to get tricky to get shots of her. She's also less than thrilled that I've put her image all over the internet for the world to see, though she does insist on final cut approval before I put the videos up on the website. She will be thrilled, however, that you referred to her as a "young woman." She does look a lot younger than her actual age -- I'm a lucky man!
PTravel is offline  
Old Apr 22, 2007 | 1:53 pm
  #35  
Original Poster
FlyerTalk Evangelist
 
Join Date: Mar 2004
Location: Newport Beach, California, USA
Posts: 36,062
Just a follow-up . . .

Despite repeated trouble tickets to my web host (MySiteSpace.com), my site was hacked daily for a week. The first trouble tickets resulted in stupid responses -- "change your access password" (I did several times, but the problem was on their end, not mine), "we're installing new security software, give it a day" (I did, one week later I was still getting hacked), etc. Finally my tickets were just ignored.

Special thanks to ScottC, who pm'd me with a recommendation for a reliable web host -- I switched last night. The new host (Dreamhost.com -- why not give them a plug?) appears to be secure, reliable, faster and gives me more storage for just a little more money than those morons at MySiteSpace.

A couple of cautions if you have a website:

- ALWAYS keep a clean copy of every file on the site. I do that, which made repairing the hacked site and moving my web site to the new web host very easy -- I just ftp'd everything back up and was up and running in the amount of time it took to complete the file transfers (about an hour).

- I had downloaded the hacked index page to take a look at it in FrontPage. Then I did something very, very, very stupid. I opened the page in my web browser to see what it looked like. Perhaps because it was a local file, none of my anti-malware or anti-virus software kicked in. It contained javascript that, I'm pretty sure, installed a root kit virus; at any rate, I started experiencing serious slowdowns and crashes on my machine. I spent the better part of yesterday getting the damn thing out. Microsoft has links to some tools that help -- one is a program that tries to detect files and links hidden from the Windows API, i.e. rootkits. It found some suspicious code and links hidden in the registry. The other was a cleaner that removes registry entries that contain nulls (also used to hide root kits). Fortunately for me, the executable virus code was hidden in subfolders under temp directories so I simply removed the entire temp directory (and lost a bunch of cookies that I wanted to keep in the process, e.g. passwords, etc.), removed the null entries from the registry, removed entire key sections from the registry that I decided didn't belong, and rebooted. Everything seems back to normal, but this kind of open-registry surgery and wholesale deletion of system subfolders is not for the faint-of-heart, and I wouldn't recommend doing it unless you have a pretty good idea of how the OS works. At any rate, I digress -- hacking websites is serious business. If yours gets hacked DO NOT play with the hacked page unless you know EXACTLY what you are doing. Most of the time, the hacks are innocuous -- links inserted to boost their google scores. Sometimes, however, they're not.

- Don't pick a webhost based solely on price. If I wasn't reasonably organized on my end, I could have a lost website content that's taken me years to develop.

- You can trust ScottC's recommendations!
PTravel is offline  
Old Apr 23, 2007 | 10:43 am
  #36  
15 Years on Site
 
Join Date: May 2006
Location: SAN
Programs: UA lifetime gold, 1.8MM; Marriott lifetime Titanium
Posts: 495
Originally Posted by PTravel
Then I did something very, very, very stupid.
I stupidly clicked on one of the earlier links to your host, which opened a file tree in IE, and then continued with my stupidity by clicking on one of the folders which tried to install something. Our scanners at work picked it up, scanned my laptop for an eternity, then our porn blocker added your site as a block due to 'malicious content'... Sometimes my brain fires backwards..
sandiegofun is offline  
Old Apr 23, 2007 | 1:49 pm
  #37  
 
Join Date: Jun 2005
Location: Near an airport
Programs: FB, EB, Delta, AC, PC, HH.
Posts: 1,991
Originally Posted by sandiegofun
I stupidly clicked on one of the earlier links to your host, which opened a file tree in IE, and then continued with my stupidity by clicking on one of the folders which tried to install something. Our scanners at work picked it up, scanned my laptop for an eternity, then our porn blocker added your site as a block due to 'malicious content'... Sometimes my brain fires backwards..
I did a classic one 5 years ago. Installed my PC laptop with a full win2k server install. Me thinking "I know what I'm doing. I work at an ISP." (I did back then) stupidly did not install antivirus and firewall. Flew to Luxemburg to deliver a site, went on line from there and within seconds all the sites that were in development on my laptop were infected by that effing virus that attacked win2k servers and spread via html pages. I spent 10 minutes trying to fix it only to realise it was an impossible task, closed the lid, flew home and had to start all over again.

Since then I always travel with install disks and backups of my content on external HDD or CD/DVD despite the fact I'm now a mac user.

Can't be too cuatious these days.
Emma65 is offline  


Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service -

This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2026 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.