Results 1 to 7 of 7
  1. #1
    Join Date
    Sep 2006
    Posts
    39

    * Danger code in my website pages

    Hello everybody

    I have a starnge code in my websites pages , I found it yesterday and i went to clean the pages .

    Now after about 12 hours it came back again , It is not possible to moniter
    like this problem and clean a huge number of pages .

    I dont know how this happened , I need someone to help me to know the source of the problem from where it comes .

    It is appears as a torjan for the users .
    I attached a pic shows a sample of that code .

    Please anybody can help me its urgent to have the solution .

    Regards
    Attached Thumbnails Attached Thumbnails danger.jpg  

  2. #2
    Join Date
    May 2008
    Location
    Citrus Heights, CA
    Posts
    1,716
    check your folder and files for correct permissions, also change your ftp passwords.

  3. #3
    Join Date
    Sep 2006
    Posts
    39
    can you please explain to me why i should do that ?

    its not easy to check permissions, they are about 250,000 pages and more than 500 folders

  4. #4
    Join Date
    Oct 2002
    Location
    State of Disbelief
    Posts
    22,950
    From shell (assuming Cpanel):
    Code:
    find /home/*/public_html/ -perm 0777 >file.txt
    Open file.txt once it completes.

    If it's just one account (launch command from public_html folder of the account):
    Code:
     find . -perm 0777 >file.txt
    Having problems, or maybe questions about WHT? Head over to the help desk!

  5. #5
    Join Date
    Mar 2009
    Location
    LAX, DAL, MIA, ATL, ORD
    Posts
    8,982
    That look's like the Gumblar exploit which overwrite's all the html file's simply remove them and contact your hosting provider and make sure you scan all your file's. It will keep happening until you remove the file it's located in your image's folder check it out you will see a .php file in there or a weird looking image remove it and your all good. Please tell me if it worked. Good luck.

  6. #6
    Join Date
    May 2008
    Location
    Citrus Heights, CA
    Posts
    1,716
    In addition, unmaskparasites.com has a great scan tool.

    http://blog.unmaskparasites.com/2009...jected-script/

  7. #7
    Join Date
    May 2009
    Location
    SLASH ROOT
    Posts
    853

Similar Threads

  1. WTH Coder - 2 Pages code.
    By ZaxiHosting in forum Design Requests
    Replies: 3
    Last Post: 06-22-2008, 11:42 PM
  2. Replies: 3
    Last Post: 04-02-2007, 04:06 AM
  3. Replies: 0
    Last Post: 03-29-2006, 03:06 PM
  4. How to execute php code into html pages?
    By _goliath2 in forum Hosting Security and Technology
    Replies: 7
    Last Post: 12-22-2004, 11:13 AM
  5. Adding Banner Code to All pages, How can I do this?
    By wmac in forum Hosting Security and Technology
    Replies: 6
    Last Post: 09-05-2002, 03:32 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •