HaCKeD By BeLa & BodyguarD
I am posting a ticket, but I need to know if this happening to everyone on the server or just her account!
Server is… WIN11
Can other confirm if they have been hit or not???
Tickete Number is CDU-19069-515
Your’s is the only ticket so far reporting a hack.
we’ll look over it, and find out how the hacker got in.
But just FYI, 99% of the hack reports we get are simply script exploitations.
Can you give an example?
The common apps on site are Wordpress, SMF Forums, Joomla, DNN 3.1.1.
Just in case someone could provide some feedback.
Working with tech support through tickets… looks isolated to index files.
joomla and wordpress have somepretty major hacks that allow uploads or overrides of the admin password, then they can upload a php editor that can access other domains in the folder.
Just this clients sites, can confirm that 100% here.
I will get you the logs of what happened here before long, its just a ton of domain logs to go through.
Found the logs sending to you in ticket, its quite long but it is a vulnerable install of Joomla/Mambo that is at fault.
Sent you logs, sent you domain hack originated from, and need to know what you want from us next.
Thanks… continuing in ticket…
Just following up to make sure you got the clients instructions in the ticket.
Yep, Manish will be working on it and if does not get done before shift end it will go to the next shift tech to complete.
Oh gosh… I hope it gets done before shift end… I hate having a job started by one and finished by another… it just increases the odds of miscommunication and confusion.
So how long is it before shift end?
[RS #DNT-38633-711]
client site hacked too and JODO said server is fine
maybe anyone could confirm this?
What server were you on?
We believe it was Joomla and or SMF Forums on this client’s site.
No
what is seriouse is that it is pure html and root directory is embed a hacked index.htm
serverzb,
This was a TOTALLY different issue and much earlier in the month.
And, it was on win12 as well.
And this one you refer to actually happened a nearly a month before it had a ticket created, making it incredibly hard to find any information. It happened 9/15/06 and you reported 10/12/06
Greg, your directions from client came 30 minutes before the shift end.
Has anyone started on it yet? I sent their needs about 2 hours and 10 minutes ago.
being worked on, but since we are having to select files in other places it will take longer.
A total account restore can happen pretty quick. but certain files takes longer. I will tell Prakash to go ahead and get the main hacked domain back up first and then to work with file selections.
I just updated the ticket to make sure the subdomains of that domain are fully done as well.
Does your backup software NOT have a selective restore? The software I use is just as easy to do a full restore as it is a selective… when I say selective I mean a way of saying restore all files of index.* and so forth.
Greg