PhPNuke 7.7 Hacked

Nuke Cadet Joined: Nov 23, 2006 Posts: 4

Oki, here´s my problem, I´m useing PHP Nuke 7.7, since today (around 3 hours ago) I have this part of code on the Index Site (seen with FF show Sourcer), checked:
footer.php
header.php
config.php
and some other files for this code, but none of them had the code inside.

Here´s the code:

Code:

<td bgcolor="#BA9F70" height="30" background="themes/Chronicles/images/cellpic3.gif"><table width="100%" border="0" cellspacing="0" cellpadding="4">

<tr>
<td><font class="block-title"><strong>The KOBAY <iftaarla sunar lee kroo ezdızarımm:)))</strong></font></td>
</tr>
</table></td>
</tr>
<tr>
<td bgcolor="#BA9F70" background="themes/Chronicles/images/gen_background.jpg"><table width="100%" border="0" cellspacing="0" cellpadding="4">
<tr>

<td><font class="content"><div id="Layer1" style="position:absolute; left:0; top:0; width:1000; height:2500;z-index:1; background-color: #000000; layer-background-color: #ccccc; border: 1px none #000000"> <strong><font color="#777777" face="Verdana" <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<div><strong><div align="center"><a href="http://imageshack.us/"><img height="129" alt="Image Hosted by ImageShack.us" src="http://www.the-hackers.net/forum/images/light/template/header.gif" width="376" border="0" /></a> </div><br />
<div align="center"><img height="105" src="http://img167.imageshack.us/img167/3770/worldan1.gif" width="113" border="0" /> </div><br />
<div align="center">The KOBAY </div><br />
<div align="center">ThT SALDIRI TEAM </div><br />
<div align="center">CRAZY TURKS COME </div><br />
<div align="center"><img height="120" src="http://www.the-hackers.net/forum/images/light/template/header.gif" width="394" border="0" /> </div><br />
<div align="center" /><br />
<p align="center"> </p>

<div align="center">tHE kobay</div><br />
<div align="center">Contack: THE-HACKERS.NETdiv><br />
<div align="center">THEKOBAY@......<br />
<div align="center"><img height="138" src="http://www.the-hackers.net/forum/images/light/template/header.gif" width="354" border="0" /> </div><br />
</div></strong></div></font></td>
</tr>
</table></td>

Any Idea how I can remove it?
btw: www.bdl-uo.de/index1.php

is the site I´m talking about

Captain Joined: Sep 13, 2003 Posts: 314

I have had similar hacks on my site and they used the coppermine gallery to upload a fake index.php to the site. I had the original index.php available, so I just uploaded it to the site and everything was normal again.

Nuke Cadet Joined: Nov 23, 2006 Posts: 4

Coppermine is not installed, there is even no other "upload" function active on this site, but will check if uploading a backuped up index.php will solve it, thanks Smile

ahh btw, made a typo:
www.bdl-uo.de/index.php
is the site

Edit: did not work, uploaded the original index.php file I created for this site

Captain Joined: Sep 13, 2003 Posts: 314

Besides index.php they hacked sometimes config.php, which was cured by uploading a backup copy of it. I am not sure that the problem here is config.php, but it is simple to try.

Nuke Cadet Joined: Nov 23, 2006 Posts: 4

Same result,
I really have no idea where to search now ...

Nuke Cadet Joined: Nov 23, 2006 Posts: 4

Oki, we got it, was written into nuke_blocks, so if anyone else is having this problem, check this with your SQL Program

Captain Joined: Sep 13, 2003 Posts: 314

Glad to hear that you could fix it so rapidly. I have never before heard that nuke_blocks have been tampered with, so it was an important information.

Site Admin Joined: Aug 17, 2003 Posts: 12397

Note: if you aren't running the latest Patched files (from http://www.nukeresources.com) and Nuke Sentinel (from http://www.nukescripts.net) - do so ASAP