Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I stumbled upon this hijack, when I broke the urls on my page.

http://pastebin.com/WCjJL1Qe

pagesinxt hijack redirect script.

I can't find where this script is being called. Anyone else having this problem? Once I fixed all the broken urls, the problem goes away.

share|improve this question
    
possible duplicate of My server's been hacked EMERGENCY –  Shane Madden Jun 1 '12 at 1:21
    
Turns out the issue wasn't on my server. I originally broke my server by forgetting to change a .com in my config to .ca It turns out the server it was trying to pull resources from the .com, has a redirector in it. The "pagesinxt" was on a different server entirely. That's why I wasn't able to find it via grep. –  Danny Jun 1 '12 at 1:22
    
Ahh, that'll do it! –  Shane Madden Jun 1 '12 at 1:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.