Simple Edit / Removal Of Problem Blog Gadgets

Blog owners frequently have to edit or remove various blog gadgets - and sometimes need coaching, to edit or remove.

Editing or removing gadgets, normally, is pretty simple - when you know what you're looking for. Whenever you are logged in to Blogger, as a blog administrator, you can find the "Edit" link, on the dashboard Layout wizard - or the "Quick Edit" link on the blog (when "Quick Edit" is enabled), as displayed.

Sometimes, identifying a problem blog gadget, to another person, isn't easy. What happens, if someone misreads your instructions?

Even when identified, it may not be a simple task to locate a given gadget.

• The "Quick Edit" option may not be enabled, on a blog.
• Even when "Quick Edit" is enabled, a blog with lots of gadgets may be tedious to search, looking for the gadget in question.
• Mistakes can be made. What happens, if you click on the wrong link, and remove the wrong gadget?
• When a malicious or misbehaving gadget is involved, either loading the blog or the dashboard may produce unacceptable results.

Fortunately, with the right diagnostic work, we may not have to load either the blog, or the dashboard, to edit or remove an identified gadget.

Start by locating, and identifying, the gadget in question. As an example, I will use a gadget from my test blog. First extract the code, for gadget "HTML13" - my so called "Empty HTML Gadget".

<div·class='widget·HTML'·id='HTML13'>(LF)
<h2·class='title'>Empty·HTML·Gadget</h2>(LF)
<div·class='widget-content'>(LF)
This·is·a·(<span·style="font-weight:bold;">somewhat</span>)·empty·HTML·gadget.(LF)
</div>(LF)
<div·class='clear'></div>(LF)
<span·class='widget-item-control'>(LF)
<span·class='item-control·blog-admin'>(LF)
<a·class='quickedit'·href='//www.blogger.com/rearrange?blogID=6231987187698503326&widgetType=HTML&widgetId=HTML13&action=editWidget§ionId=sidebar-right-1'·onclick='return·_WidgetManager._PopupConfig(document.getElementById("HTML13"));'·target='configHTML13'·title='Edit'>(LF)
<img·alt=''·height='18'·src='http://img1.blogblog.com/img/icon18_wrench_allbkg.png'·width='18'/>(LF)
</a>(LF)
</span>(LF)
</span>(LF)
<div·class='clear'></div>(LF)
</div>

Look for "quickedit" - and extract the "href" value.

//www.blogger.com/rearrange?blogID=6231987187698503326&widgetType=HTML&widgetId=HTML13&action=editWidget§ionId=sidebar-right-1

Be really careful here - extract the complete string, between the ' ... '.

Add "https:" to the front of the extracted value.

https://www.blogger.com/rearrange?blogID=6231987187698503326&widgetType=HTML&widgetId=HTML13&action=editWidget§ionId=sidebar-right-1

And there is the exact URL needed, to access the Edit wizard, for the gadget, "HMTL13".

Now, to point out the "obvious".

• The URL will work, for the gadget on any blog, even if "Quick Edit" is not enabled for the blog - for a blog administrator.
• The URL will not work, for the gadget on any blog, even if "Quick Edit" is enabled for the blog - for a non blog administrator.
• Disclosure / possession of the URL poses no security threat to your blog - nor any benefit to a hacker. Try the link below, and see for yourself.
• Even if you are logged in as an administrator, the URL may not work - if "third party" cookies are not enabled.

The URL is simply a tool, which can be extracted, by anybody - and can be used, by a blog administrator (and only by a blog administrator), when properly logged in to Blogger.

Having noted the "obvious", your life can be a bit simpler, when instead of having to instruct someone how to locate and use the correct "Quick Edit" or Layout Edit link, to remove a problem gadget, you simply instruct them.

Login to Blogger, and click on the link below:
https://www.blogger.com/rearrange?blogID=6231987187698503326&widgetType=HTML&widgetId=HTML13&action=editWidget§ionId=sidebar-right-1.
Then click "Remove".

Now, extract and try a link from your blog - and see for yourself. Isn't that simpler?

Identifying And Removing Deviously Engineered And Marketed Blog Hijacks

We saw the symptoms of the first carefully engineered blog hijacks, in Blogger Help Forum: Something Is Broken, two years ago. During each succeeding holiday season, each attack has apparently become more and more deviously engineered.

This season - each season starting in Fall of one year and lasting until Spring of the following year - we are seeing a hijack complement which appears to be devious in both marketing and installation technique, and which requires a complex search of the affected blogs. If you are receiving reports from your readers

Your blog starts to load - but is quickly replaced by a page full of advertisements!

you may need to exhaustively examine your blog for any third party code - and as always, the problem code may have been installed at any time in the past. When discovered, the hijacks are not consistently found in recently installed code.

The blog hijacks, being examined during this holiday season - appear to be deviously planned and marketed.

• The hijacks use a variety of host accessories and gadgets.
• The hijacks use a variety of distribution libraries.
• The hijacks are being marketed to a diverse audience, which causes different installation techniques - and necessitates the complex search of affected blogs.

To find and remove a hijack from an affected blog, you'll need to start by viewing the blog in question, using a text only browser, or proxy service. I, personally, use several products.

• hpHosts vURL is a text only browser, that runs as a stand alone application locally on your computer.
• Notepad-Plus-Plus is an offline text editor, which provides a variety of search tools for text files. You can sometimes avoid use of your browser completely, by copying page source code directly from vURL.
• Rex Swain's HTTP Viewer is a standard online text proxy that I use.
• Lingo4you HTTP Web-Sniffer is an online alternative to Rex Swain.

All of these products may be more or less useful in identifying the source of your specific hijack. The Rex Swain and Web-Sniffer text proxies each have their effective differences.

If anybody uses alternative products, and cares to share information about the tools used, I will most gratefully add them to my library here.

The approach here is complex.

1. Of course, backup the template, before starting.
2. Load the blog, in question, in the text browser / proxy display of your choice.
3. Do a simple text search for the identified host / target name in the URL, such as "adiwidget", "pagesinxt", or "ripway".
4. You'll see several different possibilities.
   • The search may reveal the hijacking code in an HTML gadget. You can use the "Pages Elements" / Design tab (Classic GUI), or the "Layout" wizard (New GUI), and remove the offending gadget.
   • The search may reveal the hijacking code in the template HTML. You'll have to use the Template Editor, and remove the offending lines of code.
   • The search may not find any identified host name, in a text search. You'll have to do an extensive text search, looking for unknown HTML / JavaScript gadgets / snippets of code, and evaluate each gadget / snippet, on the fly.
5. You may need to bypass the Blogger menu structure, to directly access the Blogger wizard needed, if trying to use the Blogger menus is also a problem.
6. Clear browser cache, before checking for success.
7. And always backup the template, again, after completing this task.

And hopefully, having found and removed a hijack from your blog, you will learn to be more discrete, in your choice of accessories and gadgets, in the future.

Identifying And Removing HTML / JavaScript / XML Based Malware From Your Blog

Occasionally, in the recently discovered social engineering blog attacks that involve shiny blog accessories, we've seen reports of aggressively protected malware, that's being installed on some blogs.

When a misbehaving HTML gadget is the source of the problem, it's sometimes possible to click on the "Quick Edit" icon for the gadget, and click "Remove". Alternatively, go to "Page Elements", and click on the "Edit" link for the gadget in question. This does not always work so simply, however.

If you can't remove a recently installed gadget, because you get redirected when trying to use the "Layout" button from the dashboard, or the "Remove" button from the "Page Elements" wizard, you may have to be imaginative.

• Use a well protected browser - minimally, one which blocks scripts from any non Blogger / Google domain, to clean your blog. This is the simplest possibility here.
• Use an HTTP text proxy, to examine the blog code.
• Remove the code manually.
  1. Use a protected browser or proxy server to access the blog, and "View Source".
  2. Look in the source, and find the offending gadget / module. If it was installed as an "HTML / JavaScript" or Blogger "Add a Gadget" (XML) gadget, look at the code carefully, and look for "Gadgetnn" and "HTMLnn", where "nn" will be the sequential number for that HTML / XML gadget. This is important.
  3. Manually access the Layout "Edit HTML" wizard for the blog.
  4. Do not check "Expand widget templates" - just "Edit HTML".
  5. Look in the code, carefully, for each "Gadgetnn" or "HTMLnn" entry.

     <div class='widget Gadget' id='Gadget1' />

     or

     <div class='widget HTML' id='HTML1' />

  6. Remove that line of code.
  7. Save.
• As always, please backup the template before and after you do this cleanup!

If you cannot find an obvious culprit from a quick "View Source", then start removing all "HTML / JavaScript" gadgets, and all XML gadgets (possibly including some installed from the Blogger "Add a Gadget" wizard), installed most recently ("recently", in some cases, being 2 - 3 months back).

1. Remove a gadget.
2. Clear browser cache.
3. Test.
4. If no improvement, repeat.

Alternatively, just remove all accessories and gadgets - then re install and test everything, one by one.

1. Add a gadget back.
2. Clear browser cache.
3. Test.
4. If a problem is seen, remove that gadget and identify it.
5. Repeat.

It's your blog, and your decision which way to go. Barring any obvious suspects, I think I'd try the latter.

If you do put some accessories back, or add anything more, keep an eye on what you add, and check your blog frequently. A lot of the complaints this week appears to involve hacks that may have been installed 2 or 3 months ago. Watch out for smart code, that doesn't activate (reactivate) the hacking immediately when installed.

---

It appears that some malware may be included in some gadgets installed by the Blogger "Add a Gadget" wizard. If you find removing any Blogger gadgets to provide you any relief, please report your findings in my article Some Hijack Malware Is Being Claimed To Be Blogger Provided. Your details, provided there, would be greatly appreciated.

---