Spammers/Hacker Issue

Received this from hosting:
1 Analysis of the attack
1.1 The hackers processed it through a security leak in your script/s:
assets/snippets/reflect/snippet.reflect.php
1.2 A large amount of spam has been sent by the following script/s:
move.php
1.3 The following malicious file/s have been uploaded to your webspace:
config.old.php

Having disabled these files, we will unlock your account. Please understand that
the temporary lock was necessary to protect our infrastructure.

2. Required measures
To reestablish the security of your 1&1 webspace, please proceed now as follows:
2.1 Delete the aforementioned files. You will have to grant yourself writing
permission again before deletion. For further information see
http://faq.1and1.com/websites/access/ftp/13.html

2.2 Upload a more secure version of the following modules of your software:
Hits Domain /Script $Variable(s)
218 massexcellence.com /assets/snippets/reflect/snippet.reflect.php
$reflect_base

17 massexcellence.com
/manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php $base_path

7 massexcellence.com
/index.php/manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php
$base_path

2.3 Check whether other malicious content was uploaded onto your webspace
during the attack. Delete all unknown, suspicious content immediately.



+++++++++++++++++++++++++++++++++++++++++++++++++++++
Can someone help me out?
How do I do these?
2.2 Upload a more secure version of the following modules of your software:


2.3 Check whether other malicious content was uploaded onto your webspace

Thanks.

Please check the Security Notices forum and subscribe to security alert there, it’s a known issue :
http://modxcms.com/forums/index.php/topic,30875.0.html

From what I have read (to be checked), this only occurs when register_globals is set to On (which we advise against as any sensible person should... )

If your host doesn’t not allow you to edit php.ini then try to use this directive in your htaccess file to set register_globals to off (that is, if your host supports it).

:-[ Bad luck.
You should also change your password on 1 & 1 if possible - it may be that files were planted in your account by someone who’s got hold of your existing one.
KP

Good point Keith...

And remember I am waiting for confirmation of the register_globals set to On part.
In the meantime follow the Security Notices’s forum instruction to the letter.

register_globals On On

I am not going to be able to change this.

This is BAD for security...

Then you should follow the instructions, which basically means pending a fix, not using Reflect

okay. Where exactly is Reflect used?

I misread the security notice as Ryan pointed out to me, the files must be simply erased or renames as .txt as instructed in the security notice, Reflect doesn’t need the incriminated files (which are not included - bad assumption/memory on my part) which were provided as reference not any actual use... Case Solved.

Follow the security notice instructions: delete the file on the filesystem, though you’ve probably got mutliple malicious bits of code uploaded all over the install now.

Register_globals being on is a five-nines guarantee you will be compromised again in the future (99.999%). If you can’t change it I would change hosts. Immediately. No questions asked.

We haven’t proceeded far with this install in terms of adding content. If I delete what is on the server and re-upload what is on my local computer and then eliminate the Reflect file, would this take care of the problem. I’ve found the other founds outside of the modx that they were referring to and can eliminate them. I’m also requesting turning off the register globals.