Definitely. For example, they could have injected a plugin if they hacked your database. Sometimes, they try to mask their malicious code/backdoor into existing plugins. But first, check for all php files in directories where they should not be; then use vB diagnostic tool to check for suspicious files. This find command might help you identify some files:
Code:
find . -type f -mtime -5 -name '*.php'
Change the mtime value depending on how back in time you want to go; -mtime -5 will return only files edited in the latest 5 days.
Disabling all shell execution/inclusion functions in PHP, unless you really need them, is also a good idea to stop most attacks. Check this:
http://www.cyberciti.biz/faq/linux-u...ble-functions/
Also, try to go through your access logs to determine the point of entry: if you find that, then you have the key to clean-up everything more easily.
11-25-2009, 06:07 AM
Hybrid Mode
