I am a part time moderator/web administrator on our unofficial college website. Last year our website had been hacked and some malicious script had been placed on it which was causing redirection of some Google referred traffic. It would not resend all Google referred traffic though, it even placed its own cookie in the malicious script to ensure that people are not sent to the offending site every time but only once every 86400 seconds.

For days I searched the internet desperately to find out if it was a known thing, most sites suggested it was a .htaccess attack, but I had already suspected that and our .htaccess file was squeaky clean. Just to be sure I also checked all the .htaccess files above and below out root level and they were clean. So I was sure it was a script. If your site is hacked via the .htaccess method, there would be entries like :

RewriteEngine On
RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
RewriteRule .* http://newaddress [R,L]

After the .htaccess files were found clean, I tried some workarounds to prevent the redirection, like setting server referrer variable to null and trying to make all URLs 301 redirects but that didn’t work since the script was still able to detect the referrer as Google and redirect the website to tinyurl4.info which probably paid them a lot to get this done. It would be sent to random addresses on the tinyurl4.info site. Since the site may be hosting malware, I would request you not to go there. So this method of cloaking the referrer at my side clearly wasn’t working.

Next I created a zip file from the offending folder of the site and downloaded the whole thing using my 3G connection photon+ connection (wanted to finish it off ASAP). Once the folder was downloaded, I ran a McAfee scan of the whole thing hoping that the anti virus would be able to detect the offending code as it would be obfuscated. But I was wrong McAfee was terribly incompetent. So it was plan B , I started searching for strings like .js and tinyurl4.info to try and find the redirecting code. Windows search wasn’t very helpful here and couldn’t even find base64 which was one of the strings I searched for and was a part of the offending code.

So now it was plan C , this one worked. I listed all files in the site which had been modified within the past one year. Here is where I was able to find the culprit. One PHP file global_lang.php  had been edited in 2009 while all its peers were not listed. I grew suspicious and opened the file. To my shock, horror and relief I found the following piece of code :

which when translated turned out to be malicious code. I am not displaying the malicious code here should you get any ideas. What it was doing was checking if the person was referred by Google, Yahoo etc. and if that was true and there existed no cookie it would redirect that person after setting a cookie. The cookie ensured that once a person was redirected to the fake site, he wouldn’t be redirected for some time.

I have listed these steps here so that webmasters might be able to get a hint of how to recover from this particular type of  injection on their sites. Ofcourse, always take backups, backups ensure you can just dump them on and the malicious code is removed.

Future Proofing

There is probably no way to protect yourself from the super hackers , however you can always take precautions. First and foremost, always take backups and multiple backups. you should ideally have 12 backups from the past 12 months.

Apart from backups, ensure that the permissions on your website are always set correctly. 777 is really the devil .Never grant write permissions to outside users. 755 for folders and 644 for .php files usually works. Incase you suspect hacking, contact your host at the earliest.

Also turn off all directory listing.

Hoping you found this article helpful

After moving to Bluehost, I experienced downtime the very 2nd day, pretty significant, I got in touch with the Bluehost live chat support (pretty useless most times) who told me (in different words) , This is shared hosting, we cant do anything about downtimes or server issues, please take your issues elsewhere and switch to VPS. I very honestly asked the support person that I am bringing downtime to his notice and he is asking me to shift, suddenly he became soft and told me I had the choice to switch to another host but they wont take care of errant sites on server and neither will they assure me that downtimes would be reduced. It was like downtimes are Ok.

Anyway I kept on with Bluehost as it was overall reliable, then came the next blow : CPU throttling. Its every blog owners nightmare. PHP scripts would routinely be timed out and every time a wordpress page would load, my account would be throttled to ensure their grossly oversold servers are ok. I tried everything, using super cache, cleaning databases, removing overheads etc. But none of these helped. In an experiment, I myself would access a cached age of my account and still find that on each pageload my account is throttled. Page source would confirm a cached page was served. I own small sized blogs and such throttling out was giving me nightmares.

I don’t care what Bluehost tells you but CPU throttling is a deal breaker for me, the site would become excruciatingly slow during access.

Then began the search for the new Cpanel host. Stablehost was suggested by my brother as it had an offer offering 75% lifetime recurring discount. Interesting i said but warned him that if its too good to be true, it sometimes is. So I started to find bad reviews about Stablehost but surprisingly there was no bad review of Stablehost on the Internet, only people praising their personal customer support. I was impressed and those who know me know that customer service should be really good to impress me .

So I have signed up for Stablehost and its been more than a week and haven’t faced a single issue yet, all websites were transferred to the new account and things seem to be running smoothly. However I hope I don’t have to eat my own words. The reason I switched was that unlike other hosts, I can take a 6 month contract, yearly contract etc. for the same rate so switching is easy.

The customer care has been prompt and smooth, maximum time taken to respond was 12 hours for a domain transfer request to be initiated, otherwise I would get a reply within 10 minutes. Such a nice standard of personal customer service is a refreshing change from the robotic customer care of Bluehost who would routinely ask me to cancel my account in case of any downtime and never once reimbursed me for downtime.

Stablehost still has a 50% off coupon running on their website (use BDAY or TOS, both work) and if you are looking for a good, friendly host that offers realistic hosting, please have a look at Stablehost . The 5 GB space 100GB bandwidth plan would barely cost you $36 for the year after the discount. That’s much cheaper than bluehost and other hosts and they dont grossly oversell like Bluehost.

P.S. : These are affiliate links, but the review is 100% original and not sponsored.

But I was in for a surprise, an hour later the outlet called me and told me that no coupons were applicable on what I had ordered and asked me to pay even more money equivalent to original price of the items + tax. This call came 1 hour after my order by the way so I was all the way through the pizzas. The difference in price was around a huge difference before and after coupon.

Anyway, I didn’t want to argue so accepted the revised price (handwritten and overwritten). But this just exposes the chinks in Dominos Pizza’s offerings as the online ordering service can be very misleading especially with regards to coupons, you may think you have gotten a bargain but the local outlet can spoil your party. Wont be ordering from Dominos pizza some some time at-least.

Don’t know if the local outlet will pocket the extra money as the printed bill still lists the original price. In any case Jubilant Foods need to get their act together.

Couple that with each new channel going into a new package, Tata Sky is really an expensive proposition for the customer. Since its launch I am yet to see a customer friendly move from dear Tata Sky.

Earlier they created this Gold Pack which would have all the new channels. When people subscribed to that, they came out with lifestyle pack. Thats the latest one they are filling with channels including Discovery Science (lifestyle yeah !, wonder if they show how to make cocktails).

Before that they were notorious for hooking people on with 6 months free scheme and then raising prices like crazy.

And another instance is the unbundling of ESPN Star Sports when they had publicly humiliated and refuted Tata Sky’s claim of actually lowering costs for their customers.

Some very smart MBAs with zero concern for customers are working with this company. Lets hope they realise what they are doing wrong.

Almost everyone in my class owns a DELL and has had to invoke the warranty atleast twice. Which brings me to a good point DELL India’s warranty is probably the only thing worth writing home about. Seriously good warranty and replacement of parts once you get past the call center. That’s why I always made an online complaint whenever I needed to invoke the warranty, no need to speak to Indian call center agents who talk to you as if each replacement part is being cut out of their salary. But this post isn’t about that, its about my ownership experience with the DELL Inspiron 1525 where it fell short and where it did good.

The Good

The laptop itself is the good thing, its working alright and all of the insides work perfectly. Its easy to clean and the RAM is pretty easy to upgrade. And that’s about it.

The Bad

Extremely pathetic plastic quality. The keyboard keys are fragile (tab broke, had to be fixed with fevikwik),one of the touchpad buttons is faulty, the palm-rest plastic is discoloured and the hinges are loose. The adaptor wire seems like its ready to break off and the power button is also losing its coating of chromium (?). But to be honest, all these things were changed in warranty except the button,adaptor and hinges. The palmrest had been broken by a Dell employee in a service visit. The keyboard had stopped working twice. The replacement parts seem to be of cheaper quality than the originals which is a very worrying prospect.

The battery is by far the worst thing in the laptop and worst of all warranty customer care wont cover it. It used to give only 3.5 hours when new and now barely gives 45 minutes on battery saver mode. Its still better than one of my friend’s Inspiron 1520, after 2 years his battery stopped all backup altogether. On the contrary one of my friends’ laptop from Dubai still gives 3 hours after 1.5 years of usage. Not sure if they get a better battery in Dubai shops.

The Ugly

Well nothing really ugly about it, its just that the manufacturing is done keeping in mind to have a low period of ownership. The only ugly i see is that 1.5 years into ownership the mic stopped working and to replace it I probably need to replace the motherboard.

Would I buy a DELL again ?

Yes, but not from India. This was my first experience with DELL India and I am now a wiser man , I would much rather wait for a relative from the US and have a better quality of laptop construction and parts. I have a DELL US laptop (Vostro) and also a Lenovo US laptop and their quality seems to be much better than the India counterpart without a need to invoke any warranty even.

If you are a Paypal Indian customer, your life with Paypal is officially over thanks to the Reserve Bank of India (RBI) and the Indian Government. You would have received an email to this effect already and would have realised that the Paypal account you so cherished is now just a wormhole to bring money into your bank account. You cannot use your earnings to purchase stuff on the Internet. So you can no longer use the hard earned money from your website to purchase hosting or to pay for the domain name of the said website. Under normal Indian Tax laws, these are perfectly acceptable uses for your earned money and infact are even deducted for the purpose of calculating taxable income from your business/service. The intentions of the Government are pretty clear. They want all this forex in Indian accounts but they dont want to give any leeway to Indians who are earning this money. A sad day in cyberspace for Indians indeed.

In compliance with Indian regulations, if you are selling products and services to customers globally, please review the following important information:

•       Any proceeds or earnings received into your PayPal account from the export of    goods and services should be withdrawn to your bank account within 30 days.

•       While making the withdrawal please make sure you select the purpose code that best fits your business.

•       Any proceeds or earnings received into your PayPal account from the export of goods and services may only be withdrawn to your bank account in India.  This received amount cannot be reused for making purchases.

•    If you would like to make purchases on any website that accepts PayPal, you can continue to use any credit card issued by a bank in India.

If you do use an Indian credit card to pay via Paypal it would actually mean double payment of commission to Paypal , once at time of receiving the forex and next time at the time of sending it since Paypal earns a lot through forex rates.

Its not Paypal’s fault though, its obvious the Indian Government and RBI had a larger role to play in this fiasco.

I am really angry at Airtel right now, it all started 3 weeks ago when I decided to open Airtel Live after a span of around 4 years. I saw a link for some yoga thing, thinking that it was some application for yoga I decided to check it out. On the next page I figured out it was just a way to sell photos so I quit Airtel Live then and there. The thing to remember is the page where I quit was a portal page with links to content. I had not downloaded any content, nor was info about charges relayed to me.

After about an hour I saw that Rs.10 had been deducted from my balance and I have been subscribed to ‘celebyoga’ service. Angry that I never subscribed to the service and that the charge information wasn’t relayed to me, I called up Airtel and asked them to refund my money. The CC executive refunded my money immediately. I decided to pursue the matter and asked Airtel for how the consent for the service was obtained by me. I got a stupid copy paste reply :

We would like to assure you that just like a call gets captured only after it originates from a mobile and gets connected to the called number, similarly, the download made you gets captured only if you click on the content, which is then charged accordingly.

After exchanging 4-5 mails I was fed up and stopped pursuing the matter thinking that I didn’t lose anything. The service was deactivated after 3-4 days and repeated reminders.

Incident 2:

Then on 6th April it happened again. While driving I got a message that I have subscribed to bollywood services, I am like What the Hell (atleast they should have made it Hollywood to suit my taste). The strange thing this time was that I had NOT even opened Airtel Live.

I got my money back again but Airtel still insists I clicked on the content which is preposterous since I had deleted the Airtel Live settings after incident number 1.

They say it might have happened without my consent, strange again since I never give my phone to anyone.  I got the same reply as above and they claim they have investigated the issue. (and sent the same copy paste reply). The existence of such a copy past reply actually proves that this is happening very often that they had to make a FAQ for it.

Since they refuse to accept that I never clicked on the content its really hard for them to trace the people causing this illegal activity. Hopefully it wont happen again to my phone. I can imagine some agent sitting somewhere and randomly subscribing people to services, the sad part being that some must be gullible enough not to confront Airtel on this.

Anyway I got a followup call again with the operator insisting that I had infact subscribed to their services, I gave him a piece of my mind and he promptly retreated. I have been asking them for records of taking my consent but I haven’t been able to get a proper reply.

It must be so satisfying being Steve Jobs, you made a product, make it all jazzy, have a keynote where thousands come to attend just because there is a fruit name attached to it and later on all of these thousands of fans and more actually buy the overpriced electronics device you are peddling like soaps and toothpaste.

A recent Techcrunch article pegged the sales of the Ipad at 300k items. Not only that apparently the Apple fanatics downloaded 1 million applications from the Apple app store. Thats around 3.33 applications per Ipad (lots of money these Apple target customers have).

Its one great day for Apple but another sad day for consumers who buy sensibly and do not buy anything that shiny and has a fruit drawn on it

‘The product is yet to be released in India till now, but we can already see many import websites wagging their tails with the prospects of the rich brats ordering their Ipads asap and also those with rich uncles will get their Ipads on their next trip.

Is the Apple Ipad a game changer ? A new killer device inbetween a cellphone and a laptop ? , only time will tell.

Soon, our outlook to the blog changed, we realised that with the growing popularity of the blog, we had another power in our hands. The power to help consumers. Its very simple actually for the companies, attend to your customers or the customer plasters the internet with his experience which in turn ensures that as time progresses more and more customers find out how you ill-treat customers and in effect shy away from buying your product and services.

So if they stand to lose customers, why do companies still do it ?

1. The upper Management doesn’t know – This is the most common reason. The management of any good company would not want a single unhappy customer let alone websites dedicated to reveal their incompetence. Usually the first level customer care staff in companies is little educated and usually dont get to show influence anywhere. So when a poor customer calls them up, its the start of their power trip. They take the customer for a ride until the top management finds out and crucifies them.

2. The company cant handle it – This usually happens in telecom companies and Internet companies (You know the ones I am talking about) . They just cant handle the customer pressure for good services. They grow like crazy via aggressive pricing but are unable to get enough technically sound people to form a good customer service team.

3. The company doesn’t care – This happens in extremely big conglomerates and huge companies. Smaller and midsize companies cant afford to treat their customers like this. You will find multiple examples on this blog only wherein super large companies didn’t even respond to bad PR because they think that they are untouchable and invincible. Losing a 100 customers doesnt mean anything to them since they would gain a 1000 more with a Rs.10 drop in pricing. Sad but true !

4. The company threatens legally – This does work, and boy does it work. You can take down the original complaint, but now you have 10000 times more direct and powerful ammunition to use against the company. Threatening free speech and bloggers is the biggest sin a company can commit. Examples can be found all over the Internet.

So if you are a company who is affected by bad blogger reviews or customer testimonials, there is only 1 way you can do better, that is by attending to those complaints. Here I would like to mention a few companies which in my opinion and experience do take consumer complaints seriously :

1. Eureka Forbes – This has to be the most proactive company in terms of taking complaints seriously. I had a problem with a local franchisee and one email to these guys via Mouthshut resulted in the franchisee being crucified.

2. Hyundai – We had a problem with the dry cleaning done during a servicing, an email to the company meant an instant waiver of dry cleaning for the next time from the service center.

3. TNT Courier – They had once not delivered a package to me, a review here and one of their employees fully co-ordinated an effort to get the package to me and I had the package in my hand by next evening.

For the ones who dont, feel free to check out our archives

If you are a blogger and have been shortchanged by a company, write a review (with truth only, since if they want to pursue legally, false allegations will rule against you), email the company a copy of the review and tell them how so many people are reading about how they treat customers. That usually gets their attention.

The car in happier times

I own a Maruti 800 car which I like to maintain, the first owners of the car were a little careless which caused the car to rust at a few places, but ever since I have got the car I have tried to maintain it well. One of the most important things to maintaining a car well is of course good servicing from an Authorised Service Center.

If you search around the internet, you realise that Maruti Service Masters is supposed to be the best (and the most expensive) service centre in New Delhi. I took a day off as there is a lot of rush on weekends and was off to their service centre. The 1st time I used them they had messed up the butterfly valves in my engine, at that time I thought it might be an exception to the kind of service they offer.

At the service center, I noticed a distinct lack of concern for the customer, they get a lot of customers due to their name so do not need to take customer delight seriously.The reception person was more interested in passing the blame rather than assigning a SA and pointed me to a senior who told me they are short of staff. In the middle of the week ? I waited for half an hour before a service advisor came out and actually took down my problems.

He advised some changes, one of them un-necessary, he recommended the change of the water pump which I agreed to as he said it would lead to better fuel efficiency and smoother performance. The car servicing estimate came out to Rs. 11000 , which is pretty much near the resale value of the 14 year old car, but it being my first ever car I agreed to the uber expensive service with the assurance that engine work be carried out by an experienced mechanic who understands the old Japanese carburettor engines.

The service took one whole day and next day when I came the car was dirty from the outside, while I made payments, the car was wiped once more and cleaned for outer appearance.

Here is where it went downhill for me:

1. The service advisor insisted on a blank feedback card, thinking at that time that he had done an impeccable job, I agreed and gave him the blank feedback form which he literally snatched from my hands. He had given me a test drive.

2. On reaching home, I rolled up the windows and saw major brown dust on the windows, I didn’t feel it was worth the concern and wiped it myself.

3. After 2 days I took out the car and noticed engine oil underneath the car and lots of it. I called the service advisor and asked him what I should do, his response was to bring the car on a weekday. He did not offer to get it collected from my home or to service it on a weekend. He said there is too much rush on weekends.

4. The next day I went to college , at the college parking I noticed a super large amount of engine oil leakage, scared, I came back home early and stopped using the car so as not to cause engine damage. Also the car was giving blue smoke on cold starts.

5. Angry, I wrote 2 emails to Maruti to which I got automated responses, I decided to get the engine fixed outside the MSM as engine oil was low and I couldn’t go to their workshop with a car low on engine oil and leaking it steadily. The same day the customer care lady called me, she was apologetic, +1 to MSM here but she couldn’t really help me, promised to get back to me.

6. She didn’t get back for 7 more days, I got the timing seal issue fixed and paid 900 to the local garage to repair the problem + cost of engine oil. The blue smoke problem has persisted. She called again after 7 days and again apologised but didn’t offer to do anything, did ask me to choose MSM for my next service. I told her I would never like to visit them again.

7. I emailed Maruti and asked for a fresh feedback form to incorporate the low level of service given to me. I got no response. I even told them about blank feedback being collected, no response to that too. 3-4 days later, dad got a call from the service advisor, he gave him my number, I got the call during class and was unable to pick it up. So the grand total of 1 missed call was received by me.

8. The blue smoke at cold start issue was discussed with an engineer at Maruti (who prefers to remain anonymous), he says the MSM people probably ruptured a valve seal,

This causes engine oil to leak overnight and when I do a cold start, I see blue smoke. He told me that complaints are a regular feature at MSM and they cant handle the huge rush. Most complaints are swept under the carpet.

He told me the timing seal issue was a direct consequence of bad workmanship during water pump change.

I have decided to take things to a logical conclusion, I will keep contacting Maruti till they accept that the levels of service are actually below par at Maruti Service Masters Delhi and I have asked for them to repair my car’s blue smoke issue at another Authorised Service Center free of cost.

Till then, let this serve as a warning to anyone looking to get their car serviced at Maruti Service Masters Okhla, they seem good, but very little accountability. One expects this from them but when the company also ignores customer feedback, you know its a problem.