Register

If this is your first visit, please click the Sign Up now button to begin the process of creating your account so you can begin posting on our forums! The Sign Up process will only take up about a minute of two of your time.

Results 1 to 8 of 8
  1. #1
    Junior Member
    Join Date
    Sep 2016
    Posts
    4
    Member #
    55334

    Unwanted beacons and agencies

    Greetings. First time post, newbie to the forum.
    Briefly searched for some listings on the topic and couldn't find any.
    Hoping for a little direction.

    In research for the switch into real developing (from DnD/CSS manipulation), I've found out a hacker has been and apparently still is placing ad agencies and beacons on two of my sites.

    lewicustom.com

    cajondrumz.com

    The second is or rather used to be my pride and joy... probably lame to most of you, but all self taught coming from Homestead Tech/Intuit garbage days...

    My question... Where would I begin to search for this code and is it something I could remedy in the DnD world before making the switch?
    Thank you for any time in considering my questions.

  2.  

  3. #2
    Unpaid WDF Intern TheGAME1264's Avatar
    Join Date
    Dec 2002
    Location
    Not from USA
    Posts
    14,483
    Member #
    425
    Liked
    2783 times
    For those of you who don't know what DnD means, it means "Drag 'n Drop". It confused me for a minute too.

    What page(s) are you seeing the hacker code on, and what is the output on the screen? If you can take a screen cap, that would help. I don't see anything on either site that would suggest that you're being hacked on the surface.
    If I've helped you out in any way, please pay it forward. My wife and I are walking for Autism Speaks. Please donate, and thanks.

    If someone helped you out, be sure to "Like" their post and/or help them in kind. The "Like" link is on the bottom right of each post, beside the "Share" link.

    My stuff (well, some of it): My bowling alley site | Canadian Postal Code Info (beta)

  4. #3
    Junior Member
    Join Date
    Sep 2016
    Posts
    4
    Member #
    55334

    HACK con't

    Quote Originally Posted by TheGAME1264 View Post
    For those of you who don't know what DnD means, it means "Drag 'n Drop". It confused me for a minute too.

    What page(s) are you seeing the hacker code on, and what is the output on the screen? If you can take a screen cap, that would help. I don't see anything on either site that would suggest that you're being hacked on the surface.
    Thanks for the swift response...
    Of course just after I posted here it seemed to have all but disappeared.
    This morning I found these...(see images attached) These clips of my home pages.
    Capture web beacon clip.jpg
    Capture ad agencie clip.jpg
    AGENCY aol.JPG
    I utilize Quantcast and compete, so these beacons makes sense, but the others don't.
    If it isn't completely visible, the agency this time is Yahoo, but every other time has been completely unknown companies mostly having to do with online advertisement.

    I attempted to contact some of these companies to inquire how and why... to no avail.
    As soon as I refresh everything changes. Sometimes I had found up to 5 agencies and beacons.
    I utilize a file manager through Bluehost. This had been somehow hacked and additional files... php files were added without my knowledge in turn caused my accounts to be suspended. This happened 3 times over the last year. Funny thing was, I'm not using Wordpress, so no php... All my work was through WeeblyPro with my limited skills in html and css.
    Since the last suspension, I now frequently comb over my files and delete .php that are added. I don't know how to stop it and my host doesn't seem to help.
    I uploaded a theme from DivTag, (now since, no longer in business) as I feel is the culprit and quite possibly the hacker himself. Again, just a guess... but this is what brought me here.
    Attached Images Attached Images
    Last edited by Ravenest13; Oct 07th, 2016 at 08:28 AM. Reason: Additional images and minor wording

  5. #4
    Unpaid WDF Intern TheGAME1264's Avatar
    Join Date
    Dec 2002
    Location
    Not from USA
    Posts
    14,483
    Member #
    425
    Liked
    2783 times
    What extension is that? I've never seen it before. It's possible that you're seeing false positives.
    If I've helped you out in any way, please pay it forward. My wife and I are walking for Autism Speaks. Please donate, and thanks.

    If someone helped you out, be sure to "Like" their post and/or help them in kind. The "Like" link is on the bottom right of each post, beside the "Share" link.

    My stuff (well, some of it): My bowling alley site | Canadian Postal Code Info (beta)

  6. #5
    Junior Member
    Join Date
    Sep 2016
    Posts
    4
    Member #
    55334
    This one is through my Kaspersky...

  7. #6
    Unpaid WDF Intern TheGAME1264's Avatar
    Join Date
    Dec 2002
    Location
    Not from USA
    Posts
    14,483
    Member #
    425
    Liked
    2783 times
    Ahhh. I don't have Kaspersky so I wouldn't be able to duplicate that screen capture.

    What happens when you expand "Web Beacons"? What does it say (verbatim)?
    If I've helped you out in any way, please pay it forward. My wife and I are walking for Autism Speaks. Please donate, and thanks.

    If someone helped you out, be sure to "Like" their post and/or help them in kind. The "Like" link is on the bottom right of each post, beside the "Share" link.

    My stuff (well, some of it): My bowling alley site | Canadian Postal Code Info (beta)

  8. #7
    Junior Member
    Join Date
    Sep 2016
    Posts
    4
    Member #
    55334
    Quote Originally Posted by TheGAME1264 View Post
    Ahhh. I don't have Kaspersky so I wouldn't be able to duplicate that screen capture.

    What happens when you expand "Web Beacons"? What does it say (verbatim)?
    Typically it is only Quantcast...Occasionally it is Compete. I of course have placed these on my site LONG AGO to help with site verification and placement in search engine. I only assume this is a common practice.

    Just refreshing again I have Quantcast beacon and two new ad agencies now I haven't seen before... Brightroll and Improve Digital
    Last edited by Ravenest13; Oct 07th, 2016 at 11:13 AM.

  9. #8
    Unpaid WDF Intern TheGAME1264's Avatar
    Join Date
    Dec 2002
    Location
    Not from USA
    Posts
    14,483
    Member #
    425
    Liked
    2783 times
    Ahhh okay. Your Quantcast "beacon" (weird name, but that's Kaspersky) is some Javascript toward the bottom of your page. You'll have to remove it. It looks like this:
    Code:
    <!-- Quantcast Tag -->
    <script type="text/javascript">
    var _qevents = _qevents || [];
    
    
    (function() {
    var elem = document.createElement('script');
    elem.src = (document.location.protocol == "https:" ? "https://secure" : "http://edge") + ".quantserve.com/quant.js";
    elem.async = true;
    elem.type = "text/javascript";
    var scpt = document.getElementsByTagName('script')[0];
    scpt.parentNode.insertBefore(elem, scpt);
    })();
    
    
    _qevents.push({
    qacct:"p-7dwz3qqBkdscc"
    });
    </script>
    
    
    <noscript>
    <div style="display:none;">
    <img src="//pixel.quantserve.com/pixel/p-7dwz3qqBkdscc.gif" border="0" height="1" width="1" alt="Quantcast"/>
    </div>
    </noscript>
    <!-- End Quantcast tag -->
    It won't help with search in any way. It only tracks traffic.

    Brightroll is an ad exchange/advertising platform. IIRC, they buy inventory from places such as Google Adwords and resell it. Never used them.

    http://www.brightroll.com/

    Never heard of Improve Digital before, but they appear to be similar.

    Improve Digital - For Transparency. For Revenue. For Publishers.

    I don't see either on your site. They may be tied to Quantcast, though.
    If I've helped you out in any way, please pay it forward. My wife and I are walking for Autism Speaks. Please donate, and thanks.

    If someone helped you out, be sure to "Like" their post and/or help them in kind. The "Like" link is on the bottom right of each post, beside the "Share" link.

    My stuff (well, some of it): My bowling alley site | Canadian Postal Code Info (beta)


Remove Ads

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
All times are GMT -6. The time now is 10:38 PM.
Powered by vBulletin® Version 4.2.3
Copyright © 2019 vBulletin Solutions, Inc. All rights reserved.
vBulletin Skin By: PurevB.com