Print Page - hacked

Title: hacked
Post by: burningwheel on July 04, 2008, 01:28:36 PM

i keep getting hacked. the first time, they just changed the index.php file, the second time, they changed my forum log. this time i get the same message on index.php and when i try to login to admin

what can i do to get the forum back?

i'm using 1.1.4

Title: Re: hacked
Post by: brianjw on July 04, 2008, 01:30:58 PM

What is the message on the index.php and when you try to login to admin?

We will need as much information as you can provide in order to solve your problem.

Thanks,
Brian

Title: Re: hacked
Post by: burningwheel on July 04, 2008, 01:42:19 PM

i get this message on both

http://www.mybloodyvalentine.net/smf/index.php

Title: Re: hacked
Post by: brianjw on July 04, 2008, 01:46:57 PM

Has smf/index.php changed at all. Do you see their code in it?

You need to talk with your Host. SMF didn't let the hacker in, your insecure host did.

Title: Re: hacked
Post by: karlbenson on July 04, 2008, 01:50:14 PM

Usually that type of hack is as a result of a compromised host.
I'd recommend contacting your host asap.

However there were important security fixes in SMF 1.1.5.
So i would recommend upgrading asap.

Title: Re: hacked
Post by: burningwheel on July 04, 2008, 01:57:38 PM

no sign of index source code. here is the source code:

<html><head><title>Hacked By Neuromancer | This Web Page İs Owned By Turkish hacker ! M.Kemal Atatürk ' Adam İzindeyiz '</title>

<style>
BODY { SCROLLBAR-BASE-COLOR: #191919; SCROLLBAR-ARROW-COLOR: #33FF33; }
</style></head><body leftmargin="0" topmargin="0" alink="#00ff00" bgcolor="#000000" link="#00ff00" marginheight="0" marginwidth="0" vlink="#00ff00">
<table border="0" cellpadding="0" cellspacing="0" height="520" width="98%">
<tbody><tr>
 <td>
 
 Hacked By Neuromancer
 Vatan İçin Kan Dökmek Gerekiyorsa ,Dünyanın Şah Damarını Keseriz .!

Neuromancer Was Here..!

 

 </td>
</tr>
<tr>
 <td width="62%"> </td>
</tr>
<tr>
 <td height="353" valign="top" width="62%">
 <center>
 
 <pre>

<img src="index_files/13ga.gif" height="100" width="200">
Türk çocuğu ecdadını tanıdıkça daha büyük işler yapmak için kendinde kuvvet bulacaktır.

- Only HackinG For Turkey ! Neuromancer Was Here -
<img src="index_files/612174vatan.gif" height="90" width="700">

## Sadece Sınırlar Zorlanıyor :) OWNZ !Unable to load the 'main_above' template.

Title: Re: hacked
Post by: burningwheel on July 04, 2008, 02:05:42 PM

so how can i fix this?

Title: Re: hacked
Post by: burningwheel on July 04, 2008, 02:16:31 PM

doing a google search of some of the topics on my forum, this message appears on every page

Title: Re: hacked
Post by: burningwheel on July 04, 2008, 02:23:05 PM

Quote from: burningwheel on July 04, 2008, 01:57:38 PM
no sign of index source code. here is the source code:

<html><head><title>Hacked By Neuromancer | This Web Page İs Owned By Turkish hacker ! M.Kemal Atatürk ' Adam İzindeyiz '</title>

<style>
BODY { SCROLLBAR-BASE-COLOR: #191919; SCROLLBAR-ARROW-COLOR: #33FF33; }
</style></head><body leftmargin="0" topmargin="0" alink="#00ff00" bgcolor="#000000" link="#00ff00" marginheight="0" marginwidth="0" vlink="#00ff00">
<table border="0" cellpadding="0" cellspacing="0" height="520" width="98%">
<tbody><tr>
 <td>
 
 Hacked By Neuromancer
 Vatan İçin Kan Dökmek Gerekiyorsa ,Dünyanın Şah Damarını Keseriz .!

Neuromancer Was Here..!

 

 </td>
</tr>
<tr>
 <td width="62%"> </td>
</tr>
<tr>
 <td height="353" valign="top" width="62%">
 <center>
 
 <pre>

<img src="index_files/13ga.gif" height="100" width="200">
Türk çocuğu ecdadını tanıdıkça daha büyük işler yapmak için kendinde kuvvet bulacaktır.

- Only HackinG For Turkey ! Neuromancer Was Here -
<img src="index_files/612174vatan.gif" height="90" width="700">

## Sadece Sınırlar Zorlanıyor :) OWNZ !Unable to load the 'main_above' template.

wait, when i go look at the actual file on my ftp site, the code hasn't changed

Title: Re: hacked
Post by: burningwheel on July 04, 2008, 03:21:01 PM

looks like my host must have fixed something because it's working now

Title: Re: hacked
Post by: Kalina on July 04, 2008, 04:04:45 PM

If it happens again check the actual index.template.php of your theme.

Title: Re: hacked
Post by: SlammedDime on July 04, 2008, 04:38:06 PM

And PLEASE upgrade to 1.1.5. Its as simple as going to your Admin panel of your forum and clicking the mouse a few times on the prompts. You won't loose any mods or your themes.

Simple Machines Community Forum

SMF Support => SMF 1.1.x Support => Topic started by: burningwheel on July 04, 2008, 01:28:36 PM