Topic: How to deal with TP hack

[ip0li]

You need to ask your server admin then, since we always use root user.

[Vas]

I tried using /usr/bin/php lock.php  on it's own and it seemed to work, the response was:

usage:  lock.php  owner: group

I think that did it.  OR not ??  let me know 

[ip0li]

/usr/local/bin/php lock.php user:group

U need to use something similar to that, where user:group is your ftp user and group and /usr/local/bin/php is path to your php

best is to ask hosting support to do it for you!

[oil]

when those hackers got shells on your box, the lock doesnt help either, for me it was they did the ST variables, then the hacked the .htaccess files, well the list is endless you guys MUST cleanout your box first, if you dont do that in the first place you can lock whatever you want - it wont help

i was troubled with this hack more then anybody else, the only, and for me it was after 50+ hacks the only thing which worked permantley is to hire the cleanout package of the soft-com.biz guys, they charge 75$ one time fee for the cleanout and they keep monitoring your box for hacks for some time after it,

[Vas]

Yep, it was via scripts like tp and proton that they managed to get into my boxes - all index.php files had new includes in them, the /tmp folder had a new binary file in it called x11, which added an include <?php @include_once('/tmp/x11'); ?> on all index.php files.  I had Traffic Revenue pop ups coming up on all index files of my sites, it took me 3 days to clean all the shit, I lost $100's .... Permissions are such that it can be easy for hackers to get in. Especially when all files are 777.

Tp has to become much more safe for me to continue using it. 

It's a pity cause it's a good script otherwise.

[oil]

Yep, it was via scripts like tp and proton that they managed to get into my boxes - all index.php files had new includes in them, the /tmp folder had a new binary file in it called x11, which added an include <?php @include_once('/tmp/x11'); ?> on all index.php files.  I had Traffic Revenue pop ups coming up on all index files of my sites, it took me 3 days to clean all the shit, I lost $100's .... Permissions are such that it can be easy for hackers to get in. Especially when all files are 777.

Tp has to become much more safe for me to continue using it. 

It's a pity cause it's a good script otherwise.

true, TP / Proton was the script which caused all the hacks, however unfort. you really need to clean out your servers and it has to be done by proffessionals like the soft-com.biz guys, whenever my host cleaned it, they cleaned the hack but NOT the way they came in, so cleaning the hack does not mean your box is secure after it

[Shawn]

hire the cleanout package of the soft-com.biz guys, they charge 75$ one time fee for the cleanout and they keep monitoring your box for hacks for some time after it,

How'd you get that price?  They are charging me 25/hour

[oil]

i would say its depending on whats needs to be done, in general, for me the cleanout was 75 or for 120 cleanout with whole server tuning, i took the tuning package, and i am glad i did

[Shoplifter]

So I am finding that the geoip.inc in most of my installs has an include in it again.

Was this found to be dangerous or not ?

 

[Vas]

What does the include say ... ?  Is it reading from a folder on your server ?   Is it calling up and iframe ? 

[Shoplifter]

What does the include say ... ?  Is it reading from a folder on your server ?   Is it calling up and iframe ? 

It's encoded and I don't know what it says. It seems to cause TP to send about every 4th click to some tube site.

[oil]

he was saying post it so we can see, however most likely when its encoded remove the include, its most likely a hack

[Adam Crosso]

Guys do your job right and correct, we have much script with trade but only this one always hacked, ALWAYS ONLY YOUR SCRIPT! Do your job correct and normally, always when hack your script, the same time we losing our money because you guys playing and nobody pay to us for that, many people who we trade speak only one, stop trade with that script? Then stop write rules what to do if your script hack, do your job like other script who don't have the problem