(2010-08-17, 10:51 PM)Disciple of Nagash Wrote: [ -> ]Excellent idea!
I am downloading the full directory now anyway, as I thought as it seems to be "clean", that if it happens again I can use it to replace the corrupted files.
Also, maybe do a find from PHPMyAdmin in CSS and templates to make sure they didn't get access to the database - just in case.
(2010-08-17, 10:57 PM)Pirata Nervo Wrote: [ -> ] (2010-08-17, 10:51 PM)Disciple of Nagash Wrote: [ -> ]Excellent idea!
I am downloading the full directory now anyway, as I thought as it seems to be "clean", that if it happens again I can use it to replace the corrupted files.
Also, maybe do a find from PHPMyAdmin in CSS and templates to make sure they didn't get access to the database - just in case.
I'm not sure how to do that part, could you just quickly run through what to do?
Cheers
(2010-08-17, 11:01 PM)Disciple of Nagash Wrote: [ -> ] (2010-08-17, 10:57 PM)Pirata Nervo Wrote: [ -> ] (2010-08-17, 10:51 PM)Disciple of Nagash Wrote: [ -> ]Excellent idea!
I am downloading the full directory now anyway, as I thought as it seems to be "clean", that if it happens again I can use it to replace the corrupted files.
Also, maybe do a find from PHPMyAdmin in CSS and templates to make sure they didn't get access to the database - just in case.
I'm not sure how to do that part, could you just quickly run through what to do?
Cheers
Well go to PHPMyAdmin and then select the *_templates table and then click Search at the top.
Then in the "template" field switch the Operator value to LIKE %...% and enter .ru in the text box
Just did it and it returned the following:
MySQL returned an empty result set (i.e. zero rows). ( Query took 0.0017 sec )
Phew! Just need to do a check of my directory now....
Looks ok then
It's a really good job mentioned for me to search my files Pirata. It found about 50 instances where the code had been input into other fules. Notepad++ was great for removing them though, just preparing to upload the clean data.
I'd contact your host and see if they can help you go through some logs so see when/how this happened.
Unfortunately my host has just changed hands and the new people are no where near as good as the old ones. Good news is that I am moving back this weekend so hopefully I should be able to prevent this again in the future.
I will see if they can find anything though.
(2010-08-18, 08:46 PM)Disciple of Nagash Wrote: [ -> ]Unfortunately my host has just changed hands and the new people are no where near as good as the old ones. Good news is that I am moving back this weekend so hopefully I should be able to prevent this again in the future.
I will see if they can find anything though.
Are you with TheForumForge?
Yup, why?
Just had notification off my host that hey have located the IP's and null routed them, though they didn't give me any specifics.