any idea how to get rid of the page they put their?

Reply

This happened to me about a week ago, but I believe I solved it for the time being. Same group, same annoying thing.

As far as their procedure, they somehow infiltrate the index page of a site and replace it with their own code. They can't actually get to most of the other files. For a forum page, I'm not sure how to get it back. Your posts are probably still there, but the index page is probably gone. Get the index file again from where you downloaded the forum/theme and paste it back. You might have to change the images up or whatever, but the actual code should remain the same. It's pretty annoying, but with Movable Type, you can just rebuild and get rid of their stupid code.

Reply

thanks. Probally would have never figured out what to do. I just wish these guys would stop hacking peoples sites.

Reply

I saw the Antilost forum with the SpyHackerz message as well.
One common problem security-wise is that members often leave files chmodded at 777 - allowing open-access to anyone with some skill (I'm not lucky enough to have that skill lol). Unless absolutely necessary, you should not leave files chmodded at that value, instead leave it at 644 (for non-excutable files, and PHP scripts that are called from another script using include() or require()), or 755 (for Perl, PHP and other script files, except as noted earlier). See my tutorial on file permissions at http://www.trap17.com/forums/nix-file-perm...iew-t41614.html for a quick review.
Regarding the cPanel issue, I get the same error while attemtping to access cpanel on my old (and still alive) free hosting account.

Reply

does anyone know exactly how i can get rid of what they did. on my index of the site it says


mySQL error: Access denied for user: 'nobody@localhost' (Using password: NO)
mySQL error code:
Date: Thursday 12th of October 2006 07:20:58 PM

I'd really appreciate if someone could help me becuase i have no clue wha to do.

Reply

re put in our database info in the config file the site will come back.

Reply

which folder would the config file be in and where do i get the info to put it in. Sorry if this sounds stupid but this has never happened to me before.

Reply

Try reuploading your forum. It won't rewrite your posts. You might want to make a backup before you do that just in case.

Reply

ok thanks i will try that.

Reply

No need to do that reuploading stuff.
I suffered from them too.
Everything is just fine they have just edited the Settings.php in your forum that SMF leaves it at CHMOD 777.
Replace the contents of it with Settings_bak.php .
The page you see 'Hacked by SpyHackerz.......' is in the Settings.php .

And now i got it how they get through.
We all leave the Settings.php CHMOD to 777 which can be accessed from a account on Trap17.com as there may be a bug with CPanel on restriction between accounts.
Using that they just change the Settings.php .
I am just assuming the bug.

Dont reload the SMF files.

Reply