plugin_internal.inc.php

davecjr · Post by **davecjr** » Wed Dec 03, 2008 2:01 pm

The scripts are gone now because I emptied the templates_c folders and that made it go away. There are two files in the root of my sites (yahoo_list and lko_list) which I do not have permission to delete. I am sure they are tied to this problem. When I view these two files, they point to the templates_c folders in my sites.

I found a lot of others with this same problem that seems to have popped up in the last month or so which is about how long I have noticed this. It just keeps coming back. I've also seen the same thing no matter what client machine I view these sites at. Here is a link to the exact same problem I'm having.

http://forum.cmsmadesimple.org/index.php?topic=27818.0

Post by **garvinhicking** » Wed Dec 03, 2008 2:55 pm

Hi!

Did you change all of your FTP, EMail and Database passwords? Your site got compromised, you must change all of them, and not forget to also change them in all correspondig config files.

Also make really sure your client PC has no virus.

Regards,
Garvin

davecjr · Post by **davecjr** » Thu Dec 18, 2008 4:39 am

Ok, it looks like my sites have been hacked again. I changed passwords for mysql, s9y, and ftp last time and restored everything and got 3 s9y sites and one Drupal site back up and running. Now they are all down again. It look like I'm not the only one in these forums having some problems like this lately. Most of the files in all of my sites are even to where I can't over write them. As some of the folks here have said, I do not have access to logs and can not change much about the server's configuration. Last time they restored all my files, they mentioned they wouldn't charge me the $150 this time. I am curious to know if anyone has a list, or if there is a list in here, of good hosts that would be suitable for s9y and Drupal?!

Post by **garvinhicking** » Thu Dec 18, 2008 11:41 am

Hi!

You did check all client machines that had the FTP account data stored for Viri, right? Use multiple antivir tools, maybe even use a knoppicilin linux boot disc to check for viruses without yoru usual OS running.

Because if one of those machines is infected with a trojan, it could easily transmit your new FTP data easily to the botnet and infect your website again.

Those trojans are very active currently. All other people that reoprted problems were always not having issues with s9y itself, but only with trojans, other installations like coppermine or drupal or by security issues of the hoster themselves.

Regards,
Garvin