CMS Hack?

sumpson · Post by **sumpson** » Mon Sep 28, 2009 6:58 am

Hello,

This hack (blank page front-end) has happened often to me (to sites where i have a specific ftp password) when i change the ftp login and remove the line everything is fine and it won't come back.

Code: Select all

else if (file_exists(TMP_CACHE_LOCATION.'/SITEDOWN'))
{
	echo "<__html><head><title>Maintenance</title></head></__body><div style="display:none"><__iframe width=814 height=568 src="xxx" ></__iframe></div><p>Site down for maintenance.</p><__body></__html>";
	exit;
}

This is the index.php file, I considered posting this because I think it has something to do with CMSMS because it is not put somewhere randomly.

Hope this helps someone.

cheers,

Philippe

replytomk3 · Post by **replytomk3** » Mon Sep 28, 2009 3:40 pm

This is a website attack that is done thru hosting storage (people can hack all websites on the same server) if the hosting company is not doing their job properly. Removing IFrame infection might take some time. Be careful of fixes posted online. Further information: http://mkrd.info/services-available/repair-website-or-server-infection.html

Rolf · Post by **Rolf** » Mon Sep 28, 2009 3:55 pm

Hi sumpson

Your site has been ftp hacked alright. Did you changd your ftp passwords yet?
But just trying to delete the iframes won't solve your problem, I'm afraid.

There will be one or more non-cmsms files somewhere on your website.
These scripts will place the iframe in your files.

So if you don't find these hack files, the iframes keep coming back...
Finding the files is one thing, removing all the iframes is another thing.

There is only one good solution and that is to delete all the files and reinstall cmsms on the existing database.
There are a lot of similar topics here on the forum.

Grtz. Rolf

Pierre M. · Post by **Pierre M.** » Mon Sep 28, 2009 5:09 pm

http://forum.cmsmadesimple.org/index.ph ... 539.0.html

replytomk3 · Post by **replytomk3** » Mon Sep 28, 2009 9:41 pm

Rolf wrote: But just trying to delete the iframes won't solve your problem, I'm afraid.

There will be one or more non-cmsms files somewhere on your website.
These scripts will place the iframe in your files.

So if you don't find these hack files, the iframes keep coming back...
Finding the files is one thing, removing all the iframes is another thing.
Grtz. Rolf

Yes, but not a problem for me. It is possible to find the script file that creates the IFrames with a search thru all files. Like I said, I can recover an IFrame infected website.

CMS Made Simple Forums

CMS Hack?

CMS Hack?

Re: CMS Hack?

Re: CMS Hack?

Re: CMS Hack?

Re: CMS Hack?