hacker alert
 

one of our MGPs just got hacked and was dishing out a trojan. I discovered an iframe in the HTML code that had this as the src:

"hahaha104;hahaha116;hahaha116;hahaha112;hahaha58; hahaha47;hahaha47;hahaha116;hahaha114;hahaha97;hah aha102;hahaha102;hahaha115;hahaha97;hahaha108;haha ha101;hahaha46;hahaha98;\
hahaha105;hahaha122;hahaha47;hahaha100;hahaha108;h ahaha47;hahaha97;hahaha100;hahaha118;hahaha52;haha ha52;hahaha49;hahaha46;hahaha112;hahaha104;hahaha1 12;"

I've just heard of this happening to a couple of other people as well so I suggest you check your sites to see if it has occured to you as well.

So far I have no idea how the code was actually inserted. We run autogallery sql 3.03 and tm3. The server otherwise looks clean from what the security guys can tell.

- jpoker

You are using a version of AGSQL with a security hole. I suggest you visit jmbsoft.com and PATCH! :thumbsup

Thanks, I will look into that.

Is your autogallery username and password "admin" ?

Sorry to hear that bro, I will check out my sites now.

I've been known to do silly things, but I didn't leave the default password
as admin, though i did leave the username as 'admin' and that opens me up to brute force attacks i guess.

my server been pretty fucking slow too

may I ask where you are hosted?

Ouch, that sounds no fun.

that's scares me

Id call the hosting company fast

do you have any php scripts ?
those are usually the culprit.

that doesnt look like the full code..

traffsale.biz ?

looks like thats the domain registered a few days ago..


oh its that idiot..

http://traffsale.biz/dl/adv435.php

same guy that got sleazy and thehun

pretty sure this site has something to do with it :) ( affiliate / trade partner)

http://marta.sexmadams.net/?rev=variusmanx

http://traffsale.biz/dl/

theres the directory of the crapola

looks like a directory of ip's of infected users..

http://traffsale.biz/dl/ips/

looks like he changed a few things

chkrootkit

The good thing is, that this guy will continue to get away with this, because itis far more important to arrest pornographers than hackers.