| Re: Please help .... all of my sites have come under attack |
| by ghia on 2008/9/28 1:01:19 Just wanted to be sure that XOOPS was not the cause or had a weak spot. And yes, experience is the total of stupidities and mistakes. By reading about them, you don't have to make yourselves. So, your post has benefit for the readers! |
| Re: Please help .... all of my sites have come under attack |
| by tank1955 on 2008/9/26 22:41:07 Ghia_, When the attacker first went after one of my sites that was using XOOPS 2.0.16, he managed to get a dump of the username and associated passwords. One of the passwords he found allowed him to gain access to one of my ftp accounts. Kind of stupid on my part not being more careful with password management. But none the less this whole ordeal has taught me a great deal. The protector log shows one of this person's attempts at acquiring the username listing. Everything on my server side is now completely secure and I am working through the upgrade of each site to XOOPS 2.3.0 I once worked with an engineer who said the only thing worse than doing something dumb is telling someone about the dumb thing you did. But you all did your best in trying to help me out so I felt I owed you all an explanation once I figured everything out. And BTW I have no clue what the post about an ftp associated virus is all about. |
| Re: Please help .... all of my sites have come under attack |
by ghia on 2008/9/26 15:36:26 Are you saying that at your sites a similar problem was caused by using a freeware FTP client program?Can you give us the name of that program? Did the virus have a name? How did you removed the problem from your PC? |
| Re: Please help .... all of my sites have come under attack |
| by elbeer on 2008/9/26 14:55:18 One more thing if you block the ip address from your server you will find you can not ftp anymore. The virus connects through proxys and the return path comes straight back to you. You will end up blocking yourself |
| Re: Please help .... all of my sites have come under attack |
| by elbeer on 2008/9/26 14:53:41 This attack is nothing to do xoops. I had it on 30 sites which i had. This is how it was done. I down loaded a nulled programme to have a look at and unknowingly injected my ftp connection with a virus which did the following. 1) Once i loaded up the ftp programme either using a software or through windows the virus became active. 2) The virus then had access to each and every site that had a user name and password stored in the memory of my local machine. 3) It then proceeded to attatch a <script> to each and every file on the servers no matter even if they were on different servers. 4) It affected all index.html, login.php, admin.php files. Easiest solution is scan your computer because it was you that actually infected all your sites by using this so called free software. A very timeous lesson learned by me. Even when I checked each file and deleted the problem piece of script. When I uploaded a clean file the virus simply attached its self to the clean up load. |
Search
Recent Posts
Who's Online
Donat-O-Meter
| Stats | |
| Goal: | $15.00 |
| Due Date: | Jul 31 |
| Gross Amount: | $0.00 |
| Net Balance: | $0.00 |
| Left to go: | $15.00 |
|
|