Badware on my forum
No but I have replaced the index.php in the main forum folder.
How can I test the site to see if it is clean?
[Edit]
Have replaced the index.php in the Themes
Code deleted
Is it ok for me to make the files read only? that is the index.php files.
[Moderator's note by Jim (Oldjim) Code deleted as the code is still picked up as a Trojan by Kaspersky even though it won't run ]
How can I test the site to see if it is clean?
[Edit]
Have replaced the index.php in the Themes
<?php
// This file is here solely to protect your Themes directory.
// Look for Settings.php....
if (file_exists(dirname(dirname(__FILE__)) . '/Settings.php'))
{
// Found it!
require(dirname(dirname(__FILE__)) . '/Settings.php');
header('Location: ' . $boardurl);
}
// Can't find it... just forget it.
else
exit;
?>
[Bad Code Modifyed To Stop From Running]
Code deleted
Is it ok for me to make the files read only? that is the index.php files.
[Moderator's note by Jim (Oldjim) Code deleted as the code is still picked up as a Trojan by Kaspersky even though it won't run ]
I hav Modifyed the code above to Stop it from Running.
Do I need to change all user Passwords on the forum?
@Gabe My computer is clean, I use Sandboxed to Run my Web Browser in.
Do I need to change all user Passwords on the forum?
@Gabe My computer is clean, I use Sandboxed to Run my Web Browser in.
Quote from: Midnight @Gabe, The code can not run so I rather leave it so people can see the code to look for.
Your choice. Because of the code that is there my browser blocks the site - I assume it will do the same for many others. Leave it like that if you are happy to loose visitors!
Just check again and it is now showing the forums - just before I posted last night it blocked it.
Rather than it being someone getting hold of a password I suspect it was done by an SQL injection. I notice that you haven't updated to 1.1.10 - that could be why your forums were attacked.
Rather than it being someone getting hold of a password I suspect it was done by an SQL injection. I notice that you haven't updated to 1.1.10 - that could be why your forums were attacked.
Quote from: jelv [snip] I notice that you haven't updated to 1.1.10 - that could be why your forums were attacked.
For me to get the forum updated to 1.1.10, I would need to put the forum back to default installation. mined you it may just be worth it, I will have a think on that one!
Quote from: Gabe [snip] It might show up in the logs.
Do you mean the forum logs?
Quote Malware can run within a sandbox.
not wen it has been Deleted.
Quote If you browse then ftp without emptying the sandbox in between
I don't.
Quote Safer to use different clients for trusted and distrusted activities.
I will fink on that one, it is just that I am so used to using Internet Explorer for ftping, but I do have FileZilla Client.
Quote [snip] if you can't find any of the usual suspects then that's encouraging.
No I can not find any of the usual suspects on my computer.