Page 1 of 1

Am i hacked?

PostPosted: Tue Nov 25, 2008 3:53 am
Author: Maddeen
Hi together,

i ´m not sure - because ive logged in to my admin-panel months ago.

But now - when i logged in, the adminindex shows me the following. Am i hacked?

Where does the damn AD came from - and how do i get rid of this shit?

[img=center:1en9512a]http://img.xrmb2.net/images/491580.jpeg[/img]

Thank you in advance for help.

Using: IM1.4.1 with phpbb2.0.23

Re: Am i hacked?

PostPosted: Tue Nov 25, 2008 9:45 am
Author: Helter
no, your not hacked. You did not update your acp.
It is a simple fix.
using your ftp client or webhosting file manager,
OPEN
your admin/index.php

Find

Code: Select all
//////////////////Â   Â  // Check for news from integramod


FIND

Code: Select all
 Ã‚        }     }////////////////////////


REPLACE both and everything in between with this

Code: Select all
//////////////////     // Check for news from integramod     $errno = 0;     $errstr = $news = '';  Ã‚     if ($fsock = @fsockopen('www.integramod.com', 80, $errno, $errstr))     {         @fputs($fsock, "GET /forum/updateNews/news.txt HTTP/1.1rn");         @fputs($fsock, "HOST]http://www.integramod.com[/url]rn");         @fputs($fsock, "Connection: closernrn");  Ã‚         $get_info = false;         while (!@feof($fsock))         {              if ($get_info)              {                  $news .= @fread($fsock, 1024);              }              else              {                  if (@fgets($fsock, 1024) == "rn")                  {                       $get_info = true;                  }              }         }         @fclose($fsock);  Ã‚     }     else     {         if ($errstr)         {              $news = '<p>' . sprintf($lang['Connect_socket_error_integra'], $errstr) . '</p>';         }         else         {              $news = '<p>' . $lang['Socket_functions_disabled'] . '</p>';         }     }////////////////////////  


SAVE and re check your acp

*note, when you copy this code, turn off the line numbers so you dont include them by clicking LINE NUMBER ON/OFF in the top of the code box

Re: Am i hacked?

PostPosted: Wed Nov 26, 2008 1:42 pm
Author: Maddeen
Hi Helter,

thx a lot -- the girl is gone <img> but now i get this error -- i already have turned the linenumbers of.

Bad Request

Your browser sent a request that this server could not understand.
Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8a mod_bwlimited/1.4 mod_perl/2.0.4 Perl/v5.8.8 Server at http://www.integramod.com Port 80


and -- i got another problem .. the code paste of any user (except you) is showed to me wrong .. i see some codes like ) instead of ) or { ... why? can you help me?

Re: Am i hacked?

PostPosted: Wed Nov 26, 2008 10:33 pm
Author: Helter
try this admin/index.php

Re: Am i hacked?

PostPosted: Thu Nov 27, 2008 8:02 am
Author: Maddeen
THX a lot .. i ´ll try this at home :(

Example

INSERT INTO phpbb_config (config_name, config_value) VALUES ('guest_profile','0'&#41;;

As you can see, this code will never work because of the wrong viewing/displaying.

Re: Am i hacked?

PostPosted: Thu Nov 27, 2008 9:49 am
Author: Helter
I answered that somewhere. It happens ao all posts made prior to the IM3 update. It is a utf-8 bug that I have been working on.
If you need the code right away, here is a dirty fix to get it.
create an html file on your desk top. name it something like code.html
copy the corrupted code you need to see into the html file and save it.
open the html file with your web browser.

Re: Am i hacked?

PostPosted: Thu Nov 27, 2008 10:49 am
Author: Maddeen
Thx a lot - Helter - worked fine for me  °Ã‚ °Ã‚ °