Analysis of the host:

1°- Pirates led the attack through the following scripts:

- /www/userdetail.php
- /modules/icontent/include/wysiwyg/spaw_control.class.php

2°- Malicious files have been downloaded to your site:

/www/images/views.php
/www/images/k.php
/www/language/french/mail_template/u.php
/www/language/french/mail_template/wait.php
/www/language/french/k.php
/www/language/french/questions.php
/www/language/french/verification.php
/www/language/french/verify.php
/www/modules/protector/mal.php
/www/modules/icontent/index.php
/www/modules/icontent/include/wysiwyg/spaw_control.class.php
/www/modules/icontent/include/wysiwyg/dialogs/config.php
/www/modules/icontent/include/wysiwyg/php.ini.php
/www/modules/icontent/include/wysiwyg/index.html
/www/modules/icontent/include/wysiwyg/config.php
/www/modules/icontent/include/config.php
/www/modules/icontent/inPages/Documentation_francaise_-_iContent_v4.0/images/phpinfo.php
/www/themes/phpkaox/style.php
/www/userdetail.php
/www/views.php

Thank's a lot ghia_.

I reupload the original index.php and it is working. I'll follow your advices and suggestions to see from where comes this attack.

Thank you very much

Xoops: frensh version: 2.0.18 fr
Modules: all modules are upgraded with their last version.



I inspected my index.php and i found this code:

Hello everyone,

My website was attacked with a new homepage that is inscribed "miLwo ® m 0wnz You!" ...

The site is:http://www.gardmit.org

I recovered my database as well as the root / www

Is there a way to remedy this?