Hi Guys,
In a real pickle for last week now one of my clients sites keeps having an iframe put into the index.php files right at the top, if you look in the files you can see the base64 code etc which i delete then great all fixed, but it reappears!
What we have done now is upgraded, checked the database and changed all the access codes, but still no luck!! Anyone got any ideas or can help me? Would really appreciate it!
Website - www.nishapillai.com
Brett
-
☆ A M B ☆
- 24,524 Posts
Sounds like either there is a script somewhere on the server doing this, or else their server root access is compromised (nothing to do with this site, all domains on the server would be accessible in this case).
Try changing the permission on the index.php file to read-only (444). There's no reason for the config files or the index.php files to be writable by anybody.
However, if this is a root-access exploit on the server itself, that won't help. Or it it's a Windows server.
-
☆ A M B ☆
- 2,213 Posts
I'm with sottwell, it sounds like there are some other hacked files allowing them to rehack your site easily.
You need to review every file in the web directory to check for additional exploits, you need to review the file permissions (I see the server is windows based, so more fun for you), and you need to change all passwords.
If you are still having issues could you provide us with information about your hosting company/server?
