My website hacked?

The place to talk about things that are related to CMS Made simple, but don't fit anywhere else.
Post Reply
purplerain12
Forum Members
Forum Members
Posts: 110
Joined: Thu Aug 14, 2008 10:33 am

My website hacked?

Post by purplerain12 »

Hello,

For a while my website was down for a reason i didnt know. I could still login to the admin, but the front-end did not work.

Finally i discovered some weird code in my index.php file.

Code: Select all

else if (file_exists(TMP_CACHE_LOCATION.'/SITEDOWN'))
{
	echo "<__html><head><title>Maintenance</title></head></__body><__iframe src="xxx" width=157 height=142 style="visibility: hidden"></__iframe><p>Site down for maintenance.</p><__body></__html>";
	exit;
}
The iframe code shouldn't be there. If i remove that code the site works again. After a wile the code is back again, slidely different.

Did somebode had this problem before and knows what is going on?

Bas
Last edited by Anonymous on Mon Apr 02, 2012 1:31 pm, edited 2 times in total.
Reason: Removed potential hack url
Top
AndyP
New Member
New Member
Posts: 3
Joined: Tue Jul 22, 2008 9:27 am

Re: My website hacked?

Post by AndyP »

Hi Bas,

I've seen this before, caused us lots of headaches!
This is normally the hosting FTP accounts being compromised.

We had to change hosts twice because of these attacks, each time due to leaks at the Hosting companies servers allowing hacckers to gain access.

You will be able to see when the files were changed by looking at the time stamps via ftp.

Contact yor hosting company and ask them to check the access logs for this time explaing the problem.

You may also find a new javascript file on your site. This is used to insert the new html in your pages if it is removed.

Important -- change your ftp password now so that idf the leak has been blocked hackers will not still be able to gain access to your account.

If you have a control panel with your hosting change the password on this too.


Good luck

Andy
Top
User avatar
Rolf
Power Poster
Power Poster
Posts: 7825
Joined: Wed Apr 23, 2008 7:53 am
Location: The Netherlands
Contact:
Contact Rolf

Re: My website hacked?

Post by Rolf »

Purplerain

Replied to you in the Dutch forum:
http://forum.cmsmadesimple.org/index.ph ... #msg174083

®
- + - + - + - + - + - + -
LATEST TUTORIAL AT CMS CAN BE SIMPLE:
Migrating Company Directory module to LISE
- + - + - + - + - + - + -
Image
Top
Pierre M.

Re: My website hacked?

Post by Pierre M. »

Any security alert without software version is useless.
Please monitor announcements about security releases.

Pierre M.
Top
replytomk3

Re: My website hacked?

Post by replytomk3 »

After you modify all passwords, try downloading files from your server and see if the antivirus software on your computer trips up. When I did this for someone else, Avast! warned me that php/html files themselves were infected. Backup database first.
Top
Post Reply

Return to “The Lounge”