Topic: build 43 / hacked again

[Le Petit Prince]

Hi,

we are still getting hacked, too. I also found suspicious files in my ST folder now

Some code I can read.. the other files are encoded in ioncube

Code: [Select]

<?php //0047b
if(!extension_loaded('ionCube Loader')){$__oc=strtolower(substr(php_uname(),0,3));$__ln='ioncube_loader_'.$__oc.'_'.substr(phpversion(),0,3).(($__oc=='win')?'.dll':'.so');if(function_exists('dl')){@dl($__ln);}if(function_exists('_il_exec')){return _il_exec();}$__ln='/ioncube/'.$__ln;$__oid=$__id=realpath(ini_get('extension_dir'));$__here=dirname(__FILE__);if(strlen($__id)>1&&$__id[1]==':'){$__id=str_replace('\\','/',substr($__id,2));$__here=str_replace('\\','/',substr($__here,2));}$__rd=str_repeat('/..',substr_count($__id,'/')).$__here.'/';$__i=strlen($__rd);while($__i--){if($__rd[$__i]=='/'){$__lp=substr($__rd,0,$__i).$__ln;if(file_exists($__oid.$__lp)){$__ln=$__lp;break;}}}if(function_exists('dl')){@dl($__ln);}}else{die('The file '.__FILE__." is corrupted. Ensure that you use binary mode when transferring files with FTP and disable the 'TAR smart cr/lf feature' if using WinZIP\n");}if(function_exists('_il_exec')){return _il_exec();}echo('Your server does not support IonCube-encoded files.<br>Please  run <a href=tpupdater.php?id=versions>tpupdater.php
Should I attach the files I found at this post or sent it to killdozer?

All the best!

[ip0li]

Send to kildoozer please.

[oil]

right after kildozer cleaned out the server yesterday ..... today morning server was hacked again !!!!!!!!!

[oil]

right after kildozer cleaned out the server yesterday ..... today morning server was hacked again !!!!!!!!!

.... wonder when this will end, kildozer i sent you the apache logs to download for the hack right after you cleaned it out

[Ska]

any news on this?

[oil]

any news on this?

server has been cleaned out, and so far so good, will prolly know more tommo, cause the last couple of days i had the hack each and every new day

[Kildoozer]

To everyone who want to check the server for backdoors - please download http://www.scriptpulse.com/scan.zip, unzip and upload to any of your site, provide me a link to kildoozer@scriptpulse.com
I'll analyze results and tell you what to do next.

[Kyler]

How do you know if your hacked, I droped that scan on both my servers and it found nothing but how would I know if Ive been hacked

[ip0li]

If it found nothing U are safe .

U would notice some ads on site, strange TP behaviour, updates wouldn't work, scanner would show wrong files etc. Hack affected less then 1% of our users and we are doing all we can to stop it on their servers.

[Shoplifter]

Running the scanner shows about a third of my sites with the following errors:

tp_in.php 21348 January 22, 18:25:47 Wrong checksum

tp/vtop.php 37235 January 18, 13:49:02 Wrong checksum

[Kildoozer]

2 Shoplifter: what updater said? I mean all files were updated successfully?

[Shawn]

And the ads are back again.  Ran scanner, No wrong files found.
Ran scan.php Scan was completed 15370 d 0:14:29 ago. No suspicious code found
And yet it's there, google's nice enough to give my sites a virus warning now so no wonder my sales suck.

Once I delete tpupdater.php and rerun the massupdate it downgrades to Version 1.0.6 build 35, reupgrading to current version works then but scanner now finds twilight_loader.php file  I'll send that to kildoozer

[ip0li]

Shawn check PM please. thnx.

[Shoplifter]

2 Shoplifter: what updater said? I mean all files were updated successfully?

After an update the scan is clear, but I have others saying they are getting safe browsing warnings on my sites. I can't see the warning with Chrome so I am not sure what is up.

Traffic is way down tho so something is wrong that I cannot see.

[Shawn]

I've noticed the newer injected ads seem to only appear for me once but other people get them repeatedly and the search engines and browsers throw warnings, guess the hackers getting smarter.