LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 02-25-2014, 03:08 AM   #16
PatriceJ
LQ Newbie
 
Registered: Oct 2008
Distribution: Debian
Posts: 21

Original Poster
Rep: Reputation: 0

Did you notice the htmlvaue.com url?
this site is empty and do not accept robots
 
Old 02-27-2014, 04:04 PM   #17
Corpus-Khu
LQ Newbie
 
Registered: Oct 2011
Posts: 19

Rep: Reputation: Disabled
Sorry for suggesting to run the code.. Not sure that the corrupted files would reflect the modified date of the day they were changed, however in case they did I would have search for all files modified around the same date and time as the one you found containing the malicious code.
 
Old 02-27-2014, 04:36 PM   #18
Habitual
Senior Member
 
Registered: Jan 2011
Distribution: Undecided
Posts: 3,156
Blog Entries: 4

Rep: Reputation: 760Reputation: 760Reputation: 760Reputation: 760Reputation: 760Reputation: 760Reputation: 760
Seen http://stackoverflow.com/questions/2...d-on-web-pages ?
 
Old 02-27-2014, 04:54 PM   #19
astrogeek
Senior Member
 
Registered: Oct 2008
Distribution: Slackware: 12.1, 13.1, 14.1, 64-14.1, -current, FreeBSD-10
Posts: 1,739

Rep: Reputation: 597Reputation: 597Reputation: 597Reputation: 597Reputation: 597Reputation: 597
Quote:
Originally Posted by PatriceJ View Post
Did you notice the htmlvaue.com url?
this site is empty and do not accept robots
Yes, see my earlier comments.

The site is "empty" because it is not intended to deliver web pages, it only delivers whatever malicious code they want to include in your visitor's page views. It rejects bots because they deliver no value to it.

It may or may not have sent the script tags when you hit the page depending on whether they distinguish between direct browser hits and referred hits originating from the code snippet on your server. But if you were to capture the code that it returns in either case and paste it here, we can probably tell you what it does.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
new server got attacked before launching agriz Linux - Security 8 07-23-2012 08:52 AM
[SOLVED] Apache server being attacked, strange requests. miragej Linux - Server 9 10-17-2010 07:44 PM
Has my linux server been hacked/cracked/attacked? jsalelle Linux - Security 11 12-31-2009 03:11 AM
Help me. My server is attacked DDoS ndduy Linux - Security 12 11-29-2009 02:47 PM
qmail server getting attacked lsimon4180 Linux - Software 41 10-15-2004 03:44 PM


All times are GMT -5. The time now is 03:35 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration