Hangar Flying => Hangar Flying => Topic started by: Chairboy on October 22, 2006, 08:37:09 AM
Title: EZ.ORG hijacked page
Post by: Chairboy on October 22, 2006, 08:37:09 AM
To whomever can edit pages on the site, ez.org/sales.htm seems to have been hijacked with a redirect to a site that attempts to install spyware. I don't recommend anyone else visit it, it's pretty aggressive.
Title: EZ.ORG hijacked page
Post by: Waiter on October 22, 2006, 10:38:44 AM
I looked in the HTML code for the main page and found over 100 instances of redirects. These are all grouped together and are designed to redirect your browser if certain hyperlink tags are clicked. I'm fairly confident that these redirects were planted along with the "iframe" that we discovered several weeks ago.
I don't remember seeing these a couple weeks ago, but I wasn't looking for this type of HTML entry (I was looking specificallly for references to to an iframe with a specific filename)
I'm not sure how you happened on these as I couldn't find any reference to their hyperlink tags, i.e. how you managed to get to one of these redirects. Without the hyperlink tag, the only way to activate the redirect is to physically type in the correct url address.
Do you remember how you were able to get the redirect to pop up, i.e. what hyperlink you clicked on??
Anyway, Sysco needs to search the original source HTML for the following text;
<a href="http://www.ez.org/images/online
He'll see immediately what I'm talking about. I would delete all of these occurances in the main page.
ALSO, remove the /images/online folder from the web sites directory. If you look there, You'll see were all these redirects are actually going to.
Waiter
PS - I'd be very curious as to how the source code became infected, This may be left over from the original problem we had with some ads that were placed a few weeks ago
Anyway, double check you backup copies and make sure they are not infected..
Title: EZ.ORG hijacked page
Post by: Chairboy on October 22, 2006, 01:19:05 PM
Yep, was googling 'Long ez for sale'. It's been spidered by Google, and is one of the top links.
Title: EZ.ORG hijacked page
Post by: admin on October 22, 2006, 06:22:14 PM
I'm not sure what is going on yet, but I've shut down the main page.
Do not access www.ez.org/sales.htm -- you will get infected and that page seems to be the source of the problem.
Title: EZ.ORG hijacked page
Post by: admin on October 23, 2006, 07:17:15 AM
The main page and sales (pre 2004) was restored from local copies.
I'll post an update when we find out whats going on.