Site possibly got hacked

**Doc911** · 05-10-2005, 05:19 AM

Trojan.Anicmoo

**Holly** · 05-10-2005, 05:24 AM

Don't click on that link unless you have some kind of AV running.

**sixxxthsense** · 05-10-2005, 05:26 AM

Originally posted by Holly

Don't click on that link unless you have some kind of AV running.

2 late hehe ''

i should be fine ;)

**sixxxthsense** · 05-10-2005, 05:27 AM

jamie do you use IE to edit comus thumbs pages?

**fireorange** · 05-10-2005, 05:27 AM

Yeah, I noticed it on Saturday.

http://www.gofuckyourself.com/showthread.php?t=464621

**Spunky** · 05-10-2005, 05:27 AM

Relatively harmless..see that on a few sites..do a search ..there was a thread about your site awhile back

**Ramster** · 05-10-2005, 05:29 AM

Too bad Jamie. Same thing has happened to many others. TommysBookmarks too and I think he said the infection was right in apache on the server.

**jamie55** · 05-10-2005, 05:30 AM

Originally posted by sixxxthsense

jamie do you use IE to edit comus thumbs pages?

I use Opera 8.0 to edit Comus.

Regarding what spunky said, I had a kinda same situation to my site a while back, but that was a security breach within comus, that got patched immediately. I take it the same hacker didn't entirely loose contact with my server and can still do shit too it.

I did a search on GFY and found that thehun and sleazydream got attacked by the same stuff, can't get in touch with them unfortunately ...

Any ideas on what todo / check?

Thanks

**fireorange** · 05-10-2005, 05:30 AM

I read somewhere about a hacked up Apache module which inserts the code while serving the surfer the pages.

**jamie55** · 05-10-2005, 05:33 AM

Originally posted by fireorange

Yeah, I noticed it on Saturday.

http://www.gofuckyourself.com/showthread.php?t=464621

Ahh shit, I saw that post now. I'll have my host check apache asap, see if there's anything in there.

**jamie55** · 05-10-2005, 06:17 AM

Had my host check apache, he found nothing ... any other clues? I really need help on this!

**Barefootsies** · 05-10-2005, 06:26 AM

I had a similar problem when I first started my TGP but the problem was the page was going in the wrong directory. Simple and stupid I know, but I had to make sure to delete extra pages, and just keep the ../../whatever.shtml.

Basically what was happening was when it would do a page rebuild, it would use an older page, not the one with the code on it. So every 10-15 minutes I'd get an older version of the page, and through trial and error in the middle of the night found problem was just duplicates, and wrong directory.

**Homer** · 05-10-2005, 06:31 AM

theres a trojan

**skillfull** · 05-10-2005, 06:32 AM

the worst is that guy isnt even doing some nice cash with that

http://iframedollars.biz/dl/stats.php?adv=adv514

**fireorange** · 05-10-2005, 07:17 AM

I can't believe your host hasn't found the problem yet.

Bitchslap c h o o p a for me, I was gonna get a few servers from them last week!

**darksoul** · 05-10-2005, 07:21 AM

If you have root access to your server, hit me up I'll take a look.

**MrVids** · 05-10-2005, 07:31 AM

heya jamie, i know you said your host looked on your box to see what it is but the exploit is 99% for sure a module that was installed on Apache. Tell your host to look for mod_stats.so and see if it exists anywhere on the box and also check to see if it appears in your httpd.conf. i run a couple tgp's, and while i've been fortunate enough to not get hit by this, a good friend of mine has and that is what his hosting co ended up finding.

also, have your hosting co installed tripwire. it will do a reporte of any major files that were edited, so you can research things like this with a little more efficiency.

**MrVids** · 05-10-2005, 07:35 AM

whoa, i just checked out who you host with. my buddy that got hacked is also a customer of ch00pa. there must be something inherintly insecure about their apache setup. give a shout to their tech Kris, he was working on my buddy's site this weekend.

**wdsguy** · 05-10-2005, 07:35 AM

Your hosting co sucks if they can't find the problem within apache.

**jamie55** · 05-10-2005, 07:55 AM

Ok, I've got it confirmed many times now, there is not a problem with apache.

My host says, "the problem is not with apache, it is with the software that runs on apache". hahahahahaha has been working on it for a 2 days now.

whoa, i just checked out who you host with. my buddy that got hacked is also a customer of ch00pa. there must be something inherintly insecure about their apache setup. give a shout to their tech Kris, he was working on my buddy's site this weekend.

Host says my problem is completely different from what Kris was working on this weekend ...

Man this is giving me a headake

**BigRod** · 05-10-2005, 07:59 AM

Get a NEW host!

**BigRod** · 05-10-2005, 08:00 AM

If you want a kick ass host icq me!

**jamie55** · 05-10-2005, 08:18 AM

MrVids, could you hit me up on icq: 162863896 , I just wanna ask you some questions, thanks!

**SmokeyTheBear** · 05-10-2005, 09:48 AM

hmmmmmm m

**Ramster** · 05-10-2005, 10:31 AM

Maybe your box was rooted. Check in any /tmp for anything owned by root. I also read that your root crontab for the html generator is a way a hacker might have gained access.

**fireorange** · 05-10-2005, 10:52 AM

Seriously though, once you're hacked, you gotta format the server and re-installing everything.

No doubt he's already installed a rootkit so you'll never be able to get rid of him.

Site possibly got hacked

Site possibly got hacked

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment