Icy Phoenix

Hello,
from tonight I cannot enter in ACP.
I receive these php errors:


The forum works but not the ACP.

The only thing I've done tonight is the upload of a personal php page (integrated in XS) in the root and the related tpò file in templates/ca_aphrodite dir.


Any ideas?
This morning ACP worked.

Thanks.

do you using firefox?
try to clear cookies and cache from browser

yes, but the problem also remains with IE

I'm thinking it is not serious problem
try to study this /web/htdocs/www.leonardisti.it/home/common.php on line 249
and I hope you'll find the answer

difus wrote: [View Post]

I'm thinking it is not serious problem
try to study this /web/htdocs/www.leonardisti.it/home/common.php on line 249
and I hope you'll find the answer

This is the last problem, not the cause, I think.

I'm with difus...

Try to look around those common.php lines or upload a brand new copy!

it was a hack attack.
They changed our files in /adm
This morning they defaced our home.
They put in our linux server (hosting aruba.it) many php files containing viruses and trojans.
They put and exe file and some pl file.
They succesfully installed a LAN listener on the server.

In your opinion, how they accessed to the server?

I installed every security patch but not this:
http://www.icyphoenix.com/viewtopic.php?t=213

Register_globals is ON and I cannot turn it off

Oh shit... maybe they did a DDoS attack on the server, through some other part of the website first? Theres some things which I am not sure cracker tracker is good at, and phpBB security seems to work better... for instance protection from trying to obtain session information from headers which I know cracker tracker fails at, but phpBBsecurity blocks... what does your host say about it?

They said:
"in your domain was found a LAN listener on the server.
This operation is now allowed and it will be considered as a system intrusion try.
If you didn't do this illegal operation, we suggest you look for some security bug in your installed apps.
In detail, the file "/includes/functions.php" was renamed by us because it was the caller of this hack listener.

If this will happen again in the future, we will send an email to the webmaster and we will proceed to lock the site to not allow again attacks like this".

Hoster is aruba.

After this email I don't know if I have to laught or to cry...

... I sent them (3 hours before their email) a full page by fax with everything explained.

just a suggestion: change host

is aruba a good hoster ?

it's very cheap and offers unlimited web space.

Aruba is known to be a really bad hoster!!!

I had some experience with them (3 months) after that I runaway from aruba. I think TheKuKa also had some problems, but I'm not sure!!!

Hi everyone,

2 of my XS's were hacked yesterday. 1 of them was a disabled XS that I haven't used for some time, had the MOCKS listening device successfully installed: /album_mod/upload/mocks-0.0.2/mocks listening on *:10080:

My web host (1and1) notified me. Later on, my main XS had the index page changed to a message with a bunch of nonsense, ending with "Sorry Mr. Admin, your security has been hacked."

I deleted the MOCKS listening files, re-uploaded my index.php, changed all passwords. My host won't allow me to shut off Globals. Today my index page was changed again.

I'm still new to php, can anyone help me to stop this from happening again? What other files should I look for?

Please help, I have a very angry red-headed wife with a bad attitude who is not happy that her board has been compromised!

Did you apply this patch?

http://www.icyphoenix.com/viewtopic.php?t=213