Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 0 down vote favorite

My website www.alittlepresent.co.uk was attacked yesterday morning and i have cleaned everythign off the FTP and reinstalled fresh copy of mybackup however they have done it again. is therea way of blocking ?

they leave few files in the website which is base64 decoded. also a txt file 150be24c26f4aa277a96fd68c91f3b48AuthCode: 306426

i look forward for answers

share|improve this question
That hash (MD5) doesn't bring up any results which means it's not a "default" or "very easy" password, though AuthCode could be a salt. I think they're leaving a backdoor open so they can come back and mess things up or use your server for malicious things. Can you please paste the entire source code of the Base64 stuff they leave behind? I'll analyze it and see if I can find who is doing this and/or how to stop it. Check your server logs!!! Look for odd requests, errors, etc. – ionFish Jun 25 '12 at 0:36
i found the person he left his Email into the one of the file and search from Facebook and its a idiot from IRAN who works for a IT company in IRAN. i have deleted the file that had Autocode however when i reinstalled the file it came back on after hour. – Aslan Kaya Jun 25 '12 at 1:05
The comment character limit doesnt allow me to send all the code here – Aslan Kaya Jun 25 '12 at 1:06
if you can send me your email i can forward these codes to you – Aslan Kaya Jun 25 '12 at 1:09
14201 alittlepresent.co.uk (420 s) [23/Jun/2012:21:58:01 +0100] "sh" (/bin/bash) sh -c echo "uname -a";echo "id";/bin/sh sh 14201 alittlepresent.co.uk 0u IPv4 1799488201 0t0 TCP 79.170.44.145:35924->2.176.214.121:2121 (ESTABLISHED) sh 14201 alittlepresent.co.uk 1u IPv4 1799488201 0t0 TCP 79.170.44.145:35924->2.176.214.121:2121 (ESTABLISHED) sh 14201 alittlepresent.co.uk 2u IPv4 1799488201 0t0 TCP 79.170.44.145:35924->2.176.214.121:2121 (ESTABLISHED) – Aslan Kaya Jun 25 '12 at 1:11
show 4 more comments

closed as too localized by John Conde♦ Jun 25 '12 at 0:44

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.

Browse other questions tagged or ask your own question.