Site hacked?

Customer Support Customer Only Discussion
1

One of my websites has recently plummeted out of Google’s search rankings, and in using Google’s Webmaster Tools I’ve discovered that a bunch of spam links are being appended to the end of the pages on the site, after the closing tag.

The spam links are only visible when viewing the site through Google’s “Fetch as Googlebot” tool. They’re not visible when you View Source on the page, and I’ve checked the files themselves, and none of them include the extra content. Most of the files haven’t been modified in months, and the last modified date on all of them supports that.

The content on the pages in question is database driven, but I’ve looked at the data in the database, and it doesn’t appear to have been compromised.

Some background: The site is written in ColdFusion, is hosted on winCF, and uses a MS SQL Server database.

Does anyone know how this garbage is being appended to my web pages, and more important, how to get rid of it?

2

Sounds like a very complex hack, and sounds like SQL injection made it if you ask me.

3

It wasn’t SQL Injection.

A file call onrequestend.cfm had been placed in the root directory of my web site. In ColdFusion, when that file exists, it’s automatically appended to the end of every page. Code in that file was adding the spam links to the end of all my pages. Once I deleted it, the spam disappeared.

I’ve reset both my ControlPanel and FTP passwords. I had some virus/spyware issues with one of the PCs I use to access the site a few months ago, and can only assume that’s when the password was compromised.

4

ok, glad you found it! I did not think about that, like a global.asa on asp.