Knowledgebase » Knowledgebase » Others

There have unknown script embedded in my files

Mark — Wed, 21 Oct 2009 13:12:15 GMT

Overview
When you visit an infected site your PC may become infected. Your infected PC may be compromised with Spyware thus sending off FTP access information to the malicious. Your password and username is then used to hack your sites by embed its script to your web files. Your site then become malware sites and spread the malware further. It may even become blacklisted by Google and other sites.

Symptoms
Your web pages are slow loading, possibly while the malicious code communicates with it's master.
When you visit the site, your computer starts frantic disk activityand browser locks up.
A bar at the top of the page prompts you to download a Microsoft Add-on.

If your PC is compromised it may display the following symptoms:
Computer has generally slowed down.
You experience browser hijacking possibly "search engine" redirection.
Other websites that you manage start to get infected.

How the hacking script looks (in asp files)
<script language=javascript></script>

How the hacking script looks (in html and js files)

</head>
<script language=javascript></script> <body>

How the hacking script looks (in php files)

<?php if(!function_exists('tmp_lkojfghx')){if(isset($_POST

----- some detail has been removed -----

lkojfghx2(); ?>

Cause
There may have malware infect your computer when you hit an infected site. The infection is some kind of spyware which extracts FTP info from your browser. Probably the URL and username. They then hack the password using brute force. A malicious login using FTP access rewrites many of your website files. (please ask our support to check your FTP logs and align the times with your file dates and times)

Resolution
1. Keeping a strong password is crucial and is the first step in protecting your website. Use a password with Upper case and lower case, numbers and symbols or characters. The longer the password the better. Change your password every 3 months at minimal.

2. Meticulously clean out all traces of the malware from your website by reloading pages or editing out the hack code. Check hidden directories for infected files.

3. Use a good virus scanner and keep it up to date. Also keep a trojan scanner on your computer. Maintaining a clean PC is good practice as one of the most popular iFrame Hacks comes from an infected PC.

4. Backing up your website is a must. You should always have a current copy of your website on your computer. Keep the files on your PC or a USB Key or External Hard Drive, it can save you from a major headache.

5. Security of file permission. Many scripts these day require you to set full permission (777 permissions on files and or folder). This is NOT safe in any way and we highly recommend you do not do that. Full Permission (777) allows users to have full access to that folder and file. To remedy this always use read/execute (755 or 644 permissions). Your script should still operate without any issues at all.

6. Keep Your Software/Scripts Up To Date. You should ALWAYS check your software or script provider for updates, patches or new versions. When software is released not only are there new features but security is always tightened and bugs are also fixed. Making sure your script is up to date is critical is maintaining a safe website.

Summary
1) reset all FTP passwords regularly.
2) keep your anti-virus update and always scan your computer for virus and malware.
3) Don't save FTP password in your FTP clients
4) use secure FTP (we published a article about secure FTP here

Google Warning / Submit "Site reconsideration" Request to Google

Mark — Thu, 10 Sep 2009 10:19:59 GMT

“My site have been attacked before.
My web developer have cleaned all site contents.
But Google still mark my site as harmful site
Anything I can do?”

1.)
Why my site still warned by Google?

Google have their management/security mechanism to manage search engine indexing records.
http://www.google.com/support/websearch/bin/answer.py?hl=en&answer=45449

Although you have cleaned the site contents, the warning record remain on Google system.
*Search engine crawling / indexing always preform periodically instead of real time.

2.)
How can i know/check if my site being warned by Google?

You should able to get the diagnostic report as:
http://www.google.com/safebrowsing/diagnostic?site=EnterYourDomainName.com
http://www.google.com/safebrowsing/diagnostic?site=www.EnterYourDomainName.com

Some browser software like Firefox and Google Chrome have Google Advisory built in. Warning might be given when browse with those browsers.

3.)
How to remove the warning?

If you check that web contents are clean, you can submit a “Site reconsideration” request to Google.
They will review the site contents after receive the request.
If it passes their review, the warning should be removed then.

4.)
Steps to submit the “Site reconsideration” request to Google:

a.) Login with Google WebMaster Tools:
http://www.google.com/webmasters/
*you need to register Google account

b.) Add your site record under google account:
- Add your site under Google webmaster tools
- "WebMaster Tools" Home -> “Add a site...”. Then enter your site URL.

c.) Verify site ownership
- After add site under your Google account. You need to verify the site ownership. There are two verification methods : Meta tag or HTML file (more easy and suggested)

Meta tag Method:
- you need to add provided metg tag into your home page
- if you are not familiar with html tag / coding, we suggest to use HTML file method

HTML file method:
- select "Verification method" - "HTML file"
- upload a HTML file with provided file name to domain folder (this HTML file can be a blank file)
- make sure you can view the page you uploaded

- click "Verify" (if you have updated with previous steps)
- the site should added and verified under your Google account

d.) Submit "Site reconsideration" request
- back to webmaster tools home
- "WebMaster Tools" Home -> "Site Reconsideration"

- Click with "Request reconsideration of your site"
- Select the site you like to request reconsideration and answer all other questions
- Request have been submitted, and you need to wait the review on Google side. You will see your request is pending like follow screenshot.

File Permission Tutorial

Mark — Mon, 25 May 2009 16:58:15 GMT

File Permissions should be used only if you wish to protect files orfolders from web browser users. If this is not your intent, you do notneed to make any modifications to your files. By default, yoursensitive folders and files (such as database files) are alreadyprotected from unwanted direct downloads. Malicious users will not beable to steal your information.

To Password-Protect files and folders, please go to control panel -> Site Admin -> Set PWD Protect.

Note: Take note that password-protecting files and folders will have NO effect on FTP user accounts.

CurrentDirectory

Use this control to switch among your directories. The Current Directory shows the physical path where the Change Directory Permission and Change File Permission commands are able to take effect.

To switch to a directory select it and click on This will show you any folders and files within that directory. You can see these under File Permission. To back out of a sub folder simply clickback on your web browser. This way you can navigate anywhere in yoursite.

ChangingDirectory/File Permissions

When you wish to to restrict access to files or folders, navigate to your desired folder or file and click on the Edit Permissionbutton . The top of your page will show your path in blue. Take noticeof this to make sure you are in the right location before you make anychanges. The second section will show you the particular rights thatare granted to up to 5 kinds of different users to the folder or filethat you selected.

*********************
Before you read any further: Most of the time you will be working with IUSR_and your member ID permissions. Do not make any changes to the rest of the users if youare not sure what the full effects of making changes will be.
*********************

IUSR_ = Internet browser users (web visitors)
INTERACTIVE = Internal computer use only
NETWORK = Internal computer use only
Administrator = Used by technical support only (We need command of your info to helpyou.)
SYSTEM = For the computer itself to manipulate your files

R = Read (This user is granted the right to READ this folder or file)
W = Write (This user is granted the right to WRITE this folder or file)
X = Execute (This user is granted the right to EXECUTE this folder or file)
D = Delete (This user is granted the right to DELETE this folder or file)
PO = Full Rights

AdministeringRights

1. Select the user you wish to modify from the pulldown menu
2. Select one or more rights ( Press Ctrl to do multiple selections.)
3. If you want the subdirectories within the directory where you are making changes
mark the checkbox.
4. Click on Make Changes

RemovingUsers

To remove/add an user:

Go to control panel -> Security > Site User Manager

NOTE:
1. Take note not to Deny Full Permissions to everyone. If this happens, NO ONE (including us) will be able to retrieve your information. Essentially, your information will be lost forever.
2. Make sure you plan carefully when granting Full Permissions. You may inadvertently change permissions so that any web user could download your sensitive information.

How to clear the cache of my browser?

Mark — Mon, 18 May 2009 11:14:23 GMT

To clear the cache of your browser, you can follow the steps below:

Firefox :

Cache : Tools > Clear Private Data > Check "Cache", " Offline Website Data" > Clear Private Data Now
Cookies : Tools > Clear Private Data > Check "Cookies" > Clear Private Data Now

IE 6 :

Cache : Tools > Internet Options > General > Delete Files
Cookies : Tools > Internet Options > General > Delete Cookies

IE 7 :

Cache : Tools > Internet Options > General > Delete > Click "Delete Files"
Cookies : Tools > Internet Options > General > Delete > Click "Delete Cookies"

Safari :

Cache : Safari > Empty Cache > Click "Empty"
Cookies : Safari > Preferences > Security > Bookmark > Show Cookies > Remove All

Chrome

Cache : Click the icon the upper right hand corner > Clear Browsing Data > Check "Empty the cache" > Clear Browsing Data
Cookies : Click the icon the upper right hand corner > Clear Browsing Data > Check "Delete Cookies" > Clear Browsing Data

How to ping under Mac?

Mark — Wed, 08 Apr 2009 13:42:30 GMT

Click on Finder in the dock
Click on Macintosh HD in the window
Click on Applications
Click on Utilities
Double-click on Network Utility
In the Network Utility window, click on the Ping tab
In the field under "Please enter the network address to ping," enter yourdomain.com or IP address
Click the Ping button

How to Display Reporting Service Reports without Authentication?

Administrator — Mon, 06 Apr 2009 11:03:58 GMT

The simplest way is to run an asp page that will fetch the report and display it.

You can do it with the following example code, just replace the URL with your own reporting url, login and password:

set objhttp = server.createobject("microsoft.xmlhttp")
url = "http://sqlreport01.mysite4now.com/ReportServer/webho_demo/Report1&rs:Command=Render&rs:Format=HTML4.0&rc:Toolbar=True&rc:JavaScript=False&rc:LinkTarget=_top&rc:Area=Report"

objhttp.open "get", url, false, "login", "password"

objhttp.send
response.write objhttp.responsetext

How to telnet under WinXP?

Mark — Thu, 05 Feb 2009 09:56:34 GMT

Please follow the steps below:

Click on Start > Programs > DOS Prompt (Windows 95-98) or Command Prompt (NT). In a Windows 2000 or XP environment, click on Start > Run. Type command into the dialog box, then click OK.
You should be able to find a black Dos command prompt. input the command that we ask you to test in the format of "telnet hostname port". For example, telnet mail.yourdomain.com 25
The telnet result appears

How to telnet under Vista?

Mark — Thu, 05 Feb 2009 00:39:17 GMT

Please follow the steps below:

By default there's no "telnet" function installed in Vista. So you have to enable it.
Go to control panel -> Choose Program and Features -> Turn Windows features on or off -> Then find a row called "Telnet Client" and tick it
Click on Start -> Run. Type command into the dialog box, then click OK.
You should be able tofind a black Dos command prompt. input the command that we ask you totest in the format of "telnet hostname port". For example, telnetmail.yourdomain.com 25
The telnet result appears

How to telnet under Mac?

Mark — Thu, 05 Feb 2009 00:36:39 GMT

Please follow the steps below:

Go to your application folder
find the Utilites folder
Open the "Terminal" application
input the command that we ask you to test in the format of "telnet hostname port". For example, telnet mail.yourdomain.com 25
The telnet result appears

Live Chat Service - to Customized Pre/Post Chat Survey/Offline Survey

Mark — Sat, 24 Jan 2009 07:22:38 GMT

Refer: http://www.sightmax.com/Operator QuickStart Guide 6/Operatorquickstart.htm#customized_pre_chat

What is a pre chat survey?
Pre chat surveys are filled out by visitors before chatting with anoperator. Most pre chat surveys ask the visitor for their name, emailaddress, company name and any other information that may be useful tothe company.

What is a post chat survey?
Post Chat surveys are filled out by visitors after the chat has endedwith an operator. You could use the post chat survey to measure theeffectiveness and level of satisfaction that the visitor had with theattending operator. The queue administrator will receive an email withthe post chat survey results. Additionally, you can view the resultsfrom the "Chat History" section of the SightMax Operator Console.

What is an offline survey?
If a visitor clicks on the chat icon and there are no operatorsavailable, they will have the option to leave a message. Once theoffline survey is filled out, it is automatically emailed to an addressspecified by the SightMax Administrator. An operator can then email thevisitor and follow up on their inquiry.

PLEASE NOTE: Only Account and Site Administrators can create/edit customized pre chat/offline surveys.

Creating a Pre or Post Chat Survey

Click 'Settings' on the Ribbon Bar, then "Chat Surveys", select thesite you want to edit, select the queue you want to edit and click 'PreChat'.

Note: Select Post-Chat for the creating a Post Chat Survey, the options are the same.

Current Pre Chat Survey

When the survey dialog opens, you will be on the 'Current Pre ChatSurvey' tab. These are the settings of your current pre chat survey.The columns 'Type', 'Label', 'Required', 'Default Value' and 'Tool Tip'will be discussed in the next section, 'New Pre Chat Survey'. These aresetup during customization.

Thedialog will display what site and queue you are editing (as shownabove). Click the 'View' button to preview the survey in HTML format.Before the preview is shown, however, you need to enter the website URLwhere SightMax is installed.

By default, the survey has the following information:

PLEASENOTE: When you add 'VisitorEmailAddress' to the pre chat survey, thepre chat survey will give the visitor the option to have the transcriptemailed to them.

New Pre Chat Survey

Click on the 'New Pre Chat Survey' tab to begin customizing your survey.

New 'Pre Chat Survey' Tab Overview

Description: Label your survey with any name you like.
Up and down arrows:Click on any of the survey types and use the arrows to move them up ordown in the list. This will determine the order they will be displayedin the final survey.
Edit: Clickon any of the survey types and then click the 'Edit' button to edittheir settings. For example, click on 'VisitorName' and click the'Edit' button.
1. Type:There are eight different types that can be created: CheckBox,CheckBoxGroup, Label, RadioButtonGroup, TextArea, TextBox,VisitorEmailAddress and VisitorName. In this example we are workingwith the 'VisitorName' type. This will create a textbox for the visitorto enter their name when filling out the pre chat survey.
2. Label:This is simply the label that will appear next to the survey type youcreate. In the example below I have created a textbox with a label of'Your name'.
3. Default Value:You can specify any default value to be shown in your textbox. In theexample below I have created a textbox with a label of 'Your name' and'Default Value' of 'Enter Full Name Here!'
4. Required:If the 'Required' checkbox is selected, then the visitor is required toenter something into the textbox to continue. (They cannot leave thetextbox blank)
5. Tool Tip: You can enter any information you would like to be displayed when a visitor hovers over a survey type you create.
Delete: Simply click on any survey type and then click the 'Delete' button to delete the survey type.
1. Confirm Item Delete:If this is selected, then any time you select a survey type to delete,a confirmation message will pop up asking if you are sure that you wantto delete that survey item. Note: This does not affect the live surveyitem on the server. The server will only replace the survey when the'Replace Current Survey' button is selected.
2. Delete Existing Survey:If checked, the server will delete the existing survey rather than justdisabling it. However, if the existing survey has responses fromprevious visitor chats, it will just be disabled.
New:Click the 'New' button to create a new pre chat survey. There are eightdifferent types that can be created: CheckBox, CheckBoxGroup, Label,RadioButtonGroup, TextArea, TextBox, VisitorEmailAddress andVisitorName.
Preview: Click the'Preview' button to preview the survey in HTML format. Before thepreview is shown, however, you need to enter the website URL whereSightMax is installed.

Replace Current Survey:When you are done editing or creating a new pre chat survey, click'Replace Current Survey' to replace and use it as your current survey.

I need to get an SSL certificate, what do I need to do?

Mark — Wed, 24 Dec 2008 13:01:49 GMT

You can buy your SSL in control panel -> Security -> Buy an SSL
or
You can use our shared SSL in control panel -> Security -> Shared SSL

My OWC chart script doesn't work

Mark — Thu, 11 Dec 2008 09:01:58 GMT

For OWC 10, you need to create your OWC component with

owc.chart

For OWC 11, you need to create it with

owc11.chartspace

How do I upgrade to VPS plan?

Mark — Wed, 10 Dec 2008 18:17:51 GMT

Please visit https://dediorder.mysite4now.com/PlanInfo.aspx to upgrade your plan to VPS.
For VPS plans detail please visit http://www.webhost4life.com/vps.asp

How do I trace route to my domain/ip?

Mark — Mon, 08 Dec 2008 12:25:46 GMT

Traceroute can be accessed at a DOS or command prompt. An Internet connection must already be established.

1. Click on Start > Programs > DOS Prompt (Windows 95-98) or Command Prompt (NT). In a Windows 2000 or XP environment, click on Start > Run. Type command into the dialog box, then click OK.

2. In the resulting command line window, type tracert hostname, where hostname can be a domain name, a machine name or an IP address.
3. Press Enter.

For example:

C:\> tracert www.hotmail.com
C:\> tracert 216.10.240.18

will show similar output:

Tracing route to hotmail.com [64.4.33.7]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms  72.249.0.65 -
2 <1 ms <1 ms <1 ms  209.249.122.73 209.249.122.73.available.above.net
3 <1 ms <1 ms <1 ms  64.125.26.213 ge-2-0-0.mpr2.dfw2.us.above.net
4 <1 ms <1 ms <1 ms  64.125.26.134 so-1-1-0.mpr4.iah1.us.above.net
5 <1 ms <1 ms <1 ms  64.125.25.18 so-1-1-0.mpr4.lax9.us.above.net
6 50 ms 61 ms 60 ms  209.133.90.29 ge-vel-net.above.net
7 50 ms 60 ms 60 ms  207.182.225.37 ge-1-3-0-1000m.cr2.vel.net
8 50 ms 70 ms 60 ms  207.182.225.146 ge-8-1-1-1000m.ex2.vel.net
9 61 ms 60 ms 60 ms 64.4.33.7 hotmail.com

Trace complete.

How do I create a sitemap for google?

Mark — Mon, 01 Dec 2008 17:55:19 GMT

Please go to below website to create a SiteMap for free:

http://www.auditmypc.com/free-sitemap-generator.asp

Cannot publish site because the publishing location status is 'Static only'.

Mark — Mon, 01 Dec 2008 17:51:59 GMT

Problem:

Error: AWStats database directorydefined in config file by 'DirData' parameter(d:\hosting\member\mahvet1/awstats) does not exist or isnot writable.

Setup('c:\hosting\html\cp\awstats/awstats.mahvet1cvillevet.com.conf'file, web server or permissions) may be wrong.
Check config file, permissions and AWStats documentation (in 'docs' directory).

Solution:

You need to create a folder name 'awstats' at your root folder.

How do I ping the domain using Windows?

Mark — Mon, 01 Dec 2008 17:30:11 GMT

1) Click on Start
2) Select “Run…”
3) Type “cmd” or “command” and press “Ok”
4) You should see the following line: C:\>. Type: "ping yourdomain.com" and press enter
5) You should get a result like this:
C:\>ping yourdomain.com

Pinging yourdomain.com [216.10.240.18] with 32 bytes of data:

Reply from 216.10.240.18: bytes=32 time<1ms TTL=62
Reply from 216.10.240.18: bytes=32 time=1ms TTL=62
Reply from 216.10.240.18: bytes=32 time<1ms TTL=62
Reply from 216.10.240.18: bytes=32 time<1ms TTL=62

Ping statistics for 216.10.240.18:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms

How do I use my static ip?

Mark — Sun, 30 Nov 2008 12:14:03 GMT

1) Please contact support via helpdesk to purchase your static ip.

2) Once support gives you your static ip, you'll need to folow the next few steps to get it to work.

Setting up your Domain DNS Record:

1) If your domain name is pointed to our DNS server, you can go to the control panel -> DNS -> DNS Zone

2) Update the following A records with the Static IP that was assigned to you:

yourdomain.com

*.yourdomain.com

www.yourdomain.com??

3) Wait 30mins for it to be updated.

Setting up your Website to correspond to the new static IP

1) Go to your control panel->site admin->change path

2) Find your URL and click on "View IP"

3) Choose the new static up and select update.

Note: depending on your ISP, it might take few hours before you'll see the updated IP.