Someone Hack My Site

[snakes1100]

I wasnt speaking for any specific dir's that require 777 to allow uploads.

I was speaking in general, 755 is good for all directories under normal circumstances.

[Lynne]

Originally Posted by snakes1100

I wasnt speaking for any specific dir's that require 777 to allow uploads.

I was speaking in general, 755 is good for all directories under normal circumstances.

*I* know what you meant. But I worry about some users who just see a statement like that and don't read what the thread is about and then blindly go change all their directories to 755 and then come post Plz Hlp!!!

[balance12]

Thanks both of you.... i change some permission. But 5 minits ago they re upload two "c99", but now with different names... one in modules and other in a vbseo carpet... they have my site to get fun =( ...... i think i should take out all the mods..... no?

[Lynne]

Have you talked to your host about this at all? Perhaps it is a problem with their security, not yours. I just reread this thread and I don't think you ever said whether you looked through your access_logs. You asked where they were, which leads me to think No and also makes me think that you may need some help from your host in finding out how these guys are getting into your files.

[Angel-Wings]

Originally Posted by Lynne

Except!!!! The following directories need to be chmod 777:
/customprofilepics
/customavatars
/signaturepics

If I may add - only if the options in AdminCP are set. When disabled the permission for members to upload pictures for avatars / signatures / profiles or storing them in the database these directories can be set to 555 without any problems.

About the problem:

Reinstall everything deleting ALL old files. You may have deleted 5 shells, can you be sure your files are clean ?
Like a "hacked" server - save everything for analysis doing a complete clean reinstall by downloading all files again from the trusted source, not your local backups.

That's the only safe way - depending on how much the hacker(s) level was, additional files have been infected - better safe than sorry

[balance12]

Thanks for all the answers. i Think i dont have other choice rather than a fresh new re-install. But i dont know how to do it. I mean i should unistall al the mods, delete the files and put new ones? Or should delete all the files , install a new version ( i hope 3.8.0) . Please i know its anoing to some one that knows. But i never had this problems and i dont want to do something wrong...... can you explain me how to do it?? like if i were a kindergarden boy jeje

[Lynne]

If you want to do a fresh install, follow Angel_Wings instructions.

But, I'll say it again (and I'll shut up and not say it again).... you need to talk to your host or view your log files to find out how they are getting onto your server. If you don't find this out, your problem will probably persist.

[Hitterman]

Use .htaccess restrictions

[balance12]

Originally Posted by Hitterman

Use .htaccess restrictions

Give me more info please....

--------------- Added [DATE]1221877829[/DATE] at [TIME]1221877829[/TIME] ---------------

I change permission, and now in the user profile you thont have the tabs to move into Options like. (Stadtics, Friends, Infactions) now it appear one under the other.. like in a list... very ugly....