My forum hacked - any help appreciated

[mcrider]

Originally Posted by MAD--DOG

see man some one must have access to an ftp to ur hosting thats the only way some one can add an index page with an image that says that you been hacked

What about a remote file include vulnerability....be careful what you wish for

[Aspergillus]

Dear m8's,

in the last few Month i observed many times so called "hacks" and it allways turned out be have been started by FTP. There ist a Trojan going arround spying out FTP Passwords.. sending them to a bot wich then goes to add a few lines to all index.php and and index.html files..
Most of the times these added lines open a hidden iframe on some page.. just tu generate clicks!!

So check your Computer for Trojan first and change all ftp passwortds (but dont do it via FTP Client) do it in Hosting Controll center.

Greez Aspi

[snakes1100]

Did you upgrade anything as i stated in my first post?

Have you implemented mod_sec or suhosin?

What your doing so far isnt going to stop him, you can block all the ip's you want, simple to get a new ip to use.

[knucklenitz]

Originally Posted by snakes1100

Did you upgrade anything as i stated in my first post?

Have you implemented mod_sec or suhosin?

What your doing so far isnt going to stop him, you can block all the ip's you want, simple to get a new ip to use.

Yes, upgraded vb to the latest.

As I understand it, mod_sec can only be implemented (by me) on dedicated servers. I plan on moving to a host that provides mod_security built into the plan, although I won't have any access to make security changes. I just can't afford a dedicated setup right now.