Topic: Exploit info

[Michal]

I noticed, that  after update some files were changed again, after new repatching I explored my sites and found that there still were left some files like cront.php and some *inc.php (unfortunately I deleted it before I wrote its name with permission 600 and date about 22 august - they were big +- 20k
 

[Shawn]

My host is still trying to remove this exploit too...  they still aren't sure how tp works because of the encoding so they aren't sure what is legit and malicious activity.  for instance: However, the only place that appears to be suspect is the tradepulse script. Why the in.php is calling exec, I don't know.

[Kildoozer]

2 Shawn: answered to email.
About exploits and 'malicious activity'. All latest versions (both ZO and IC powered) have a built-in files scanner. Scanner can be run only if you visit your admin area. If you updated your copies via network mass-updater, and haven't visit admin area of each site, scanner WON'T run.

I put this scanner to menu in the new, not released yet build, so you'll be able to scan/fix all files at any time.

But I repeat, latest builds can't be infected if you visit (at least once) your admin area after update.

If you still suspect that something goes wrong, contact me (kildoozer@scriptpulse.com) with Tp's access info, I'll help asap.