Very strange one. I have a site (Revo 2.2.7 running in IIS) which has been hacked. When a resource is requested by a search engine bot a load of viagra links are injected into the page. Any other browser sees the correct site, but with a load of empty lines at the top of the page. I've since updated to 2.2.9 but the issue's still there. There must be something intercepting requests to the site, but I can't find it. Any ideas of where to start looking?
-
☆ A M B ☆
- 24,524 Posts
Check the config.inc.php file and the index.php file. Look for suspicious Javascript or eval() functions; there shouldn't be any in those files.
Also make sure you have deleted everything in the core/cache folder
-
☆ A M B ☆
- 3,141 Posts
On top of the other suggestions, also check the .htaccess file (or the IIS equivalent) for anything that shouldn't be there, in particular auto_prepend_file/auto_append_file flags.
It's also possible a plugin can insert data to the pages, so check for anything suspicious there too.
-
☆ A M B ☆
- 30 Posts
I've been done by that one before... In my case it had injected a load of base64 encoded php into the top of every index.php file it could find on the machine.
The base64, once decoded, seemed to sniff the user agent and link source and only deface the site when the user visited via google - quite cunning really as a webmaster wouldn't see it going direct the their site.
Check all the way accross the file aswell... i missed a couple at first 'cos they had a couple of hundred empty spaces at the start of the line to push the malicious code off the side of my editor.
Do you have an older phpMyAdmin running on the server by any chance?
Thanks for your responses guys. Alan had it spot on - base64 encoded code in 143 files! Looks like I'll be rebuilding the site. It's not my server (apache all the way here) but it looks like someone has installed at least a couple of instances of phpmyadmin too.
I really can't see why the files would still be compromised after the upgrade as you would have overwritten all the affected files, if you had overwritten them all then I would make sure that all passwords to the account ( hosting, ftp, manager etc ) have been changed as you may have been hit again.
