hacker alert

[jpoker]

one of our MGPs just got hacked and was dishing out a trojan. I discovered an iframe in the HTML code that had this as the src:

"hahaha104;hahaha116;hahaha116;hahaha112;hahaha58; hahaha47;hahaha47;hahaha116;hahaha114;hahaha97;hah aha102;hahaha102;hahaha115;hahaha97;hahaha108;haha ha101;hahaha46;hahaha98;\
hahaha105;hahaha122;hahaha47;hahaha100;hahaha108;h ahaha47;hahaha97;hahaha100;hahaha118;hahaha52;haha ha52;hahaha49;hahaha46;hahaha112;hahaha104;hahaha1 12;"

I've just heard of this happening to a couple of other people as well so I suggest you check your sites to see if it has occured to you as well.

So far I have no idea how the code was actually inserted. We run autogallery sql 3.03 and tm3. The server otherwise looks clean from what the security guys can tell.

- jpoker

[diggz]

You are using a version of AGSQL with a security hole. I suggest you visit jmbsoft.com and PATCH!

[jpoker]

Thanks, I will look into that.

[KyleHoppes]

one of our MGPs just got hacked and was dishing out a trojan. I discovered an iframe in the HTML code that had this as the src:

"hahaha104;hahaha116;hahaha116;hahaha112;hahaha58; hahaha47;hahaha47;hahaha116;hahaha114;hahaha97;hah aha102;hahaha102;hahaha115;hahaha97;hahaha108;haha ha101;hahaha46;hahaha98;\
hahaha105;hahaha122;hahaha47;hahaha100;hahaha108;h ahaha47;hahaha97;hahaha100;hahaha118;hahaha52;haha ha52;hahaha49;hahaha46;hahaha112;hahaha104;hahaha1 12;"

I've just heard of this happening to a couple of other people as well so I suggest you check your sites to see if it has occured to you as well.

So far I have no idea how the code was actually inserted. We run autogallery sql 3.03 and tm3. The server otherwise looks clean from what the security guys can tell.

- jpoker

Is your autogallery username and password "admin" ?

[Makingcoin]

Sorry to hear that bro, I will check out my sites now.

[jpoker]

Is your autogallery username and password "admin" ?

I've been known to do silly things, but I didn't leave the default password
as admin, though i did leave the username as 'admin' and that opens me up to brute force attacks i guess.

[Fucksakes]

my server been pretty fucking slow too

[Fucksakes]

may I ask where you are hosted?

[High Quality]

Ouch, that sounds no fun.

[Ace_luffy]

that's scares me

[phonesex]

Id call the hosting company fast

[darksoul]

do you have any php scripts ?
those are usually the culprit.

[SmokeyTheBear]

that doesnt look like the full code..

traffsale.biz ?

[SmokeyTheBear]

looks like thats the domain registered a few days ago..


oh its that idiot..

http://traffsale.biz/dl/adv435.php

[SmokeyTheBear]

same guy that got sleazy and thehun

[SmokeyTheBear]

pretty sure this site has something to do with it ( affiliate / trade partner)

http://marta.sexmadams.net/?rev=variusmanx

[SmokeyTheBear]

http://traffsale.biz/dl/

theres the directory of the crapola

[SmokeyTheBear]

looks like a directory of ip's of infected users..

http://traffsale.biz/dl/ips/

[SmokeyTheBear]

looks like he changed a few things

[ServerGenius]

chkrootkit

[pornguy]

The good thing is, that this guy will continue to get away with this, because itis far more important to arrest pornographers than hackers.