https://www.icyphoenix.com/viewtopic.php?f=35&t=7772&p=52317#p52317
-----------------------------------
flabbergasted
Wed 06 Apr, 2011 04:03

URGENT: Site Hacked And I'm Afraid To Update Yet.
-----------------------------------
Today I went to my site at http://www.hatewalmart.com only to get a warning from firefox that the site was an attack site. I was unable to connect to the site and after a great deal of time, was presented with a warning that "Windows Security" had detected some worms or viruses or some such thin, which is kind of funny since I am running Ubuntu Linux on my laptop and obviously do not have Windows Security. I logged onto the ftp site with filezilla and found several files in the root directory that I had not put there. They were files with the extension of .dat. I also found the html.php file with a bunch of code above the 

[quote]<?php
/***************************************************************************
 *                                index.php
 *                            -------------------
 *   begin                : Sunday, March 21, 2004
 *   copyright            : (C) 2004 masterdavid - Ronald John David
 *   website              : http://www.integramod.com
 *   email                : webmaster@integramod.com
 *
 *   modded by            : Mighty Gorgon
 *   website              : http://www.mightygorgon.com
 *   email                : mightygorgon@mightygorgon.com
 *
 *   note: removing the original copyright is illegal even you have modified
 *         the code.  Just append yours if you have modified it.[/quote] section.

I deleted that and uploaded the updated file. I had to kill firefox at the command prompt to stop the redirect to the site that was playing and showing the images of the fake Windows Security scan.

The site was loading from [code linenumbers=false]http://86.55.140.203/news.php[/code] which I do not recommend anyone running windows go to. Now when I navigate the site and watch the status bar, I can see that there are still transfers coming from the above url and the domain name that refers to another site listed as an attack site by firefox. I was going to upgrade to delete any file that could still be exploited by this site, but I am wary of doing so since they might be able to inject something into the database if they are still connecting with my site during the database upgrade.

I have two questions;

How could someone have written files to my root directory?

More importantly, how do I find out where they have other files in the system to put a stop to it?

A bunch of the files in the root directory and the adm directory claim to have been modified on 4/03/2011 which was two days ago. I logged on 3 days ago and everything was fine. The permission on these files are reported by filezilla as "adfrw (0644) under the permissions column. Then under the Owner/Group column I have 642 715. It appears that permissions have been changed. 

I have 345 members at this site some of which are fairly active. I could really use some help with this.

edit: I left for awhile and again, when I attempt to navigate the site I am getting a message that says "Are you sute you want to navigate away from this site?" I have found some of the files, but I have not found all of them. I hate this little  :censored: .


