Hello,

I need a help plz,so I checked my domain today and found an error on my index.php page. When I checked the page I found that a code has been injected. Here is the code:



[EDIT by Mamba]I've replaced the domain name of the hacker, as Ghia suggested

I checked the rest of my domain and found out that every file named index has been injected with the same code, so all my index.php and index.html have been changed.

how can I remode this virus from my XOOPS site :(

Your site has been hacked. This can be due to a security failure of XOOPS, on your PC or of your hosters server. Contact your hoster for the last case.

It is important to find out how the hacker managed to get access. Check out your logs. Delete the files on your site and replace them from a recent backup. Update your site to recent and stable versions. Inspect your database for sneaky data. Change all your passwords and check all the users that manage the site on all levels (MySQL, FTP XOOPS webmasters and privileged groups). Read the advices given in some threads about hacked sites (follow show all) and the security News.

PS: Don't publish SPAM domains!

Hi,

on top of what ghia said you may post a list of used modules with versions and get some info on security treats and problems...

clear the template cache and check webmaster group for new members...

The exact same thing happened to me several months ago. The hacker managed to access and get a dump of my username and password list for the site. The password I was using to administer the site was the same password I used to access ftp.

I would suggest either looking at your server's ftp log or ask your host provider to look at the log. Even if you have to keep a hand written list of passwords I recommend never using the same password twice.

And when it comes to beefing up security for the future you should follow the advice of folks like ghia. He was fantastic at helping me work through my issues.

Quote:
Absolutely agree! And with tools like http://keepass.info/ that generate and keep passwords for you, there is really no excuse for not doing it.

Quote:
Yep, Ghia is D'Man!!! As a community we're so lucky to have him!!!