Ask Bjørn Hansen's dashboard

very helpful! thank you. i didn't know which page to look for the code. here is what i cut out of my header.php page:

One user wrote to me:

"Thank you very much for your response and please accept my apologies, as it seems your company really had nothing to do with it. If it proves helpful, the javascript responsible for the redirect was located in my themes header.php, which I was able to correct from the Word Press control panel."

I hope this is helpful.

Same problem with redirection. anyone knows how to delete it?

Also:
Wordpress Blogs using Vistered Little are being targeted by hackers

Over the last two days the number of 404s on my site increased significantly. Further investigation revealed that attempts were being made to access unusual URLs to gain access to files they wouldn't normally have access to.

More here: http://windyroad.org/2007/05/30/secur...

Got the same problem, and i'm also running WordPress. Been talking to my provider the last 15 min, and they are still looking to solve the problem.

If you are looking for the easiest way out (without solving the problem) i would recomend reinstalling the skin you are using on your page, or simply choose another skin.

I'm using a different skin while looking to solve the problem, and would very much hear if anyone has been able to locate it.

And...needless to say: my wordpress will be updated tonight:)

Hi everyone,

Those of you who sent URLs all appear to be using WordPress, so it surely is the same problem. You need to ask your hosting provider or whoever installed WordPress for you - or find a WP forum to get help upgrading it to a secure version.

The script that does the redirect is on your front pages and all include this bit of text: "function Decode()". I'm not familiar with WordPress (other than what I read up on about its security problems after this incident), so I don't have any ideas which template the worm/hacker changed.

- ask

This happened to me, also. My site is http://tunesmith-anthony.com and it's being redirected to http://xrl.us/kk3w6 also.

Help! the same thing has happened with my website: http://myoccupiedterritory.net/ and it's being redirected to http://xrl.us/kk3w6.
Can you please provide more information on how to resolve this problem? Thanks!

The same thing has happened to my site. Can you elaborate on which file contains the javascript? can you send me the javascript I need to remove? – gklingo, on July 18, 2008 02:06

I had a look at the columbusfoodandwine.com website. What the hacker did was insert the following bit of obfuscated Javascript to make your site send the users to another page as soon as your page loaded.

Remove it to stop it from happening. But! It's important that you secure your WordPress installation at the same time. It's not really clear from their announcement, but basically then some versions before 2.5.1 were insecure so anyone could "take over" your weblog.

http://wordpress.org/development/2008...

- ask

Hi Wineward & Phil,

A few others emailed me the same question. What happened to them was that someone hacked their unpatched/insecure installation of WordPress and replaced the site with a redirect to their website.

They used Metamark as an intermediary between your website and theirs. When we found out the short Metamark URL the hacker/spammer had used was disabled and that's how you end up on http://xrl.us/kk3w6 when you go to your site (before we disabled it, a user going to your site ended up on the hacker/spammers website).

update: see below for more information.

- ask

Hi Jerome,

Trust me, I hate the abuse more than you can imagine. I'm sure it's the number one reason shortening services are closing and indeed if we stop creating new URLs at some point, the annoyance of having to deal with the abuse will be the reason.

Email the spam/abuse URLs to abuse at metamark.net and we'll look into it and disable them as soon as possible.

- Ask

You may STOP all SMS messages from Loopt by replying to any SMS with STOP, END, CANCEL, UNSUBSCRIBE, or QUIT. If you receive SMS invites from people you do not know or otherwise do not like, then replying to any invitation with these words will cease all future Loopt messages.

Loopt does not store users' address book information or use it to initiate messages itself. Messages relayed by Loopt are initiated by Loopt users who already have the recipients' contact information and never initiated by Loopt.

Please don't hesitate to contact us with further questions at support@loopt.com

For the love of God, can you give Loopt a chance to fix the issues before slamming the crap out of them again? If I have you right, then Loopt are a bunch of idiots if they have a problem, idiots if they state the problem and idiots if they fix the problem. I get your frustration, but don't get beating the crap out of them while they fix it.

Until our first iPhone application update comes out that's exactly what we've done, just more efficiently: if(true) { return; } See blog.loopt.com. – Nick Sivo, on July 17, 2008 05:12

Loopt - can you just add a regex that if a contact's mobile number matches ((\(\d{3}\)?)|(\d{3}))([\s-./]?)(\d{3})([\s-./]?)(\d{4}) your service won't contact them ?

Hi All. It’s Loopt. Kathryn, thank you for such a thorough response – really appreciated. The following should cover the items you mentioned. If it does not, then just let us know and we’ll keep working at it. Thanks again. 1. Yes, Loopt does convey SMS Loopt friend invitations from User A to User B. 2. Yes, friend invitations and broadcasts are sent from Loopt subscribers to their contacts. These messages are never initiated by Loopt. These same people of course could send you SMSs from their phone, without using Loopt. 3. Yes, people may STOP all SMS messages from Loopt by replying to any SMS with STOP, END, CANCEL, UNSUBSCRIBE, or QUIT. If folks receive SMS invites from people they do not know, or otherwise do not like, then replying to any invitation with these words will cease all future Loopt messages. 4. If someone you don’t know has your mobile phone number, then this situation is unfortunate, but not related to our service. 5. Loopt does not store users' address book information or use it to initiate messages itself. Again, messages relayed by Loopt are initiated by Loopt users who already have the recipients' contact information and never initiated by Loopt. 6. Great suggestions re: user education copy for our Website. Point taken, and we’ve emailed new text copy to our Web development team to post as soon as possible. – LooptChris, on July 17, 2008 01:28

Seconded. – cwb, on July 16, 2008 22:36

What I'd *like* to see, and haven't seen so far from Loopt's postings on their UI changes, is a very large "Are you sure you wish to send an invitation via SMS to the following people?" with a list of the addressees *and the number that will be used* confirmation dialog.

FWIW: I'm not sure where you guys picked it up, but in my circle, "my/our bad" is usually associated with someone not actually caring that they've done wrong (IE - Lindsay Lohan rear-ending you then continuing on to get her double venti latte). Might I suggest future missives use a more undeniably sincere phrasing? – chrisweiss, on July 16, 2008 20:56