Icy Phoenix

Help !

Yesterday, after the sending of a message on my phpbbxs2 Build 049 website, the website was disappeared.

Now, if you click HERE, you can see that appear only a blank page.

I have also tried to see inside the index.php but it seems to be the same of original file inside the package of Build 049 Full, the only strange thing is that I have tried to upload also the original index.php file on the server and I have seen that the two files have different sizes, my index.php have 8859 Bytes and the original file have approximately 9000 bytes ... but if I rename the my index.php and use the original index.php, the problem doens't change ... I still to have blanck page.

The website can be viewed by ftp and also the db.

The hosting support has confirmed that there is not problem on the server.

Another very strange thing is that I have also received an email from an user because he says to have seen an aller message about a Trojan after the clicking on three links on internal pages.

Help me, please !!!
:|

I have also deleted all the files inside the cache directory.

I have tried another time to call the home page but nothing is changed.

But inside the cache directory are re-appeared the following files after the call of home page :

attach_config.php
sql_149.............php
sql_197.............php
sql_1ac.............php

Why ? It cold be a sign that some codes are been executed when I have typed the home page address ? some thing seems to work ? or not ?

From some weeks I have the CrakerTracker message with 7 attacks.

You can see the log file HERE, could be helpful this information to understand the problem ?

try it

make copy of your root
then in root replace all your files with original files without install and contrib
leave old config
see result

and more

go to sql [phpmyadmin]

in database do search ,containing e-mail text

clear it

difus wrote: [View Post]

and more

go to sql [phpmyadmin]

in database do search ,containing e-mail text

clear it

thank you difus for your help.

I don't understand what I need to search.

difus wrote: [View Post]

try it

make copy of your root

Done !

difus wrote: [View Post]

then in root replace all your files with original files without install and contrib

all the original files inside the full package 049 ? and the patches that I have updated before about 049 bugs ? and after this operation can I update to build 058 ?

difus wrote: [View Post]

leave old config
see result

OK !

Lucky wrote: [View Post]

difus wrote: [View Post]

and more

go to sql [phpmyadmin]

in database do search ,containing e-mail text

clear it

thank you difus for your help.

I don't understand what I need to search.

If your board will sending e-mails about trojan
the text is in your sql tables

Quote:

all the original files inside the full package 049 ? and the patches that I have updated before about 049 bugs ? and after this operation can I update to build 058 ?

you are doing the test only to find your problem is

root or sql

replace only original full package 049

About the root, I have copied all the files, directories and the DB in a new domain.

I have tried to execute the home page but the blank page appear, it's the same.

Now, I have done as you have suggest, I have copied files and directories of 049 full package without install and contrib directories and without config.php ... but nothing is changed ! I still to have blank page on screen.

About DB I'm not able to search what you have suggest to search, I don't know what is the exacly text that I need to search inside the db. Sorry. :oops: . I have tried to type inside the search field the my email address selecting all the tables. The result is anly one corrispondence to phpbb_users table.

:hurt:

1.

open "includes/functions_categories_hierarchy.PHP"

Find:



replace:



2.

replace: includes/def_themes.php, includes/def_tree.php, includes/def_words.php by the originals files.

3.

Delete cache files.

GREAT M740 !!!!!!!!!!!!!!!!!!!!!

:thanks: :thanks: :thanks:

How you know what I would must do ? Did you have the same problem ?

What was the problem ? A trojan ?

Can I modify the functions_categories_hierarchy.PHP re-changing the codes as was before ? or I need to leave so the codes changed ?

Lucky wrote: [View Post]

GREAT M740 !!!!!!!!!!!!!!!!!!!!!

:thanks: :thanks: :thanks:

How you know what I would must do ? Did you have the same problem ?

What was the problem ? A trojan ?

Can I modify the functions_categories_hierarchy.PHP re-changing the codes as was before ? or I need to leave so the codes changed ?

I have the same problem.

I don't know what it is the problem

A trojan? No, sure. Is a server or a code problem.

There is a problem ! There is not a lot of subforums ! where are they ? is changed the db ? what's happened ?

I have also found a new forums area with the name "Forums restored" (I'm not sure about the translation from Italian "Forums ripristinati") where there is two subforums ... but all the other forums are disappeared !!!