SERVERD hacked KWA VBET!

[PabloAM]

Server yangu alikuwa hacked kwa sababu nina VBET.

Huyu ni kidokezo inatuhakikishia IT:

27,888 mizizi 1 0 18:26? Ss 0:00 / usr / sbin / Exim-Mc 1OSBjj-0007Cf-4S SERVER_SIGNATURE = <address> Apache/2.2.14 (Unix) mod_ssl/2.2.14 mod_auth_passthrough/2.1 mod_bwlimited/1.4 OpenSSL/0.9.8e-fips-rhel5 FrontPage/5.0.2.2635 Server at www com **** Port 80 </ anwani>? UNIQUE_ID = TCTYtbylwV0AAEFiMjYAAABQ HTTP_USER_AGENT = Wget/1.10.2 (Red Hat iliyopita) SERVER_PORT = 80 HTTP_HOST = www com **** DOCUMENT_ROOT = / home/w11s0s3r/public_html SCRIPT_FILENAME = / home/w11s0s3r/public_html/vbenterprisetranslator_seo.php REQUEST_URI = / archive / index.php/f-23.html SCRIPT_NAME = / vbenterprisetranslator_seo.php HTTP_CONNECTION = Keep-Alive REMOTE_PORT = 41,741 PATH = / bin: / usr / bin Walemavu = / home/w11s0s3r/public_html SERVER_ADMIN = webmaster **** com REDIRECT_UNIQUE_ID = TCTYtbylwV0AAEFiMjYAAABQ REDIRECT_STATUS = 200 HTTP_ACCEPT =* / * REMOTE_ADDR = 72.55.191.104 SHLVL = 1 SERVER_NAME = www com *** HTTP_PRAGMA = hakuna cache SERVER_SOFTWARE = Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e -FIPS-mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 rhel5 QUERY_STRING = SERVER_ADDR = 188.165.193.93 GATEWAY_INTERFACE = CGI/1.1 SERVER_PROTOCOL = HTTP/1.0 REDIRECT_URL = / archive/index.php/f-23.html REQUEST_METHOD = KICHWA _ = / usr / sbin / sendmail
27,996 27,888 w11s0s3r 1 18:26? D 0:00 / usr / sbin / Exim-Mc 1OSBjj-0007Cf-4S SERVER_SIGNATURE = <address> Apache/2.2.14 (Unix) mod_ssl/2.2.14 mod_auth_passthrough/2.1 mod_bwlimited/1.4 OpenSSL/0.9.8e-fips-rhel5 FrontPage/5.0.2.2635 Server at www com *** Port 80 </ anwani>? UNIQUE_ID = TCTYtbylwV0AAEFiMjYAAABQ HTTP_USER_AGENT = Wget/1.10.2 (Red Hat iliyopita) SERVER_PORT = 80 HTTP_HOST = www com **** DOCUMENT_ROOT = / home/w11s0s3r/public_html SCRIPT_FILENAME = / home/w11s0s3r/public_html/vbenterprisetranslato ^ C


Siwezi Sakinusha VBET!
Tafadhali nisaidie server yangu ni kutuma mengi ya Spam barua pepe!
Ni kuwa kupasuka!

HELP Michał Podbielski!

[vBET]

Mimi kuchambua ujumbe wako katika wakati huu.

Wakati huo huo tafadhali kwa nini hawawezi kufanya dissable / uninstal vBET? Ni nini kinachotokea?

[vBET]

Je, unaweza tafadhali kueleza kwa nini ni wewe kufikiri kwamba ni vBET kosa? Mimi si kuona.

Pia - je kupatikana ambayo code ni kutuma barua pepe wale Spam?

Siwezi kuona jukwaa yako - vbenterprisetranslator_seo.php yaliondolewa na kanuni htacces bado akionyesha faili hii.. Admin CP ni kazi kama mimi kuona.

[PabloAM]

Yeye ni kutumia vbenterprisetranslator_seo.php kuingiza XSRIPT yake na tovuti yangu.

Wakati mimi kujaribu unistall bidhaa, na kufuta vbenterprisetranslator_seo.php kutoka server yangu mtandao wangu i dont kazi kwa sababu mahitaji "vbenterprisetranslator_seo.php" katika FTP: S

Jinsi gani naweza unistall "ALL" VBET?

Shukrani kwa ajili ya kujibu

UPDATE:
Nina kosa unistalling VBET:
http://img822.imageshack.us/img822/273/errorunistalling.jpg
http://img337.imageshack.us/img337/4927/errorunistalling2.jpg

[vBET]

Kama nilivyoandika bado una htaccess sheria akizungumzia vbenterprisetranslator_seo.php -. Tu maoni hayo.

Pia huna kufuta vBET - ni wa kutosha tu afya yake. Hasa kwamba mimi bado hawaoni ni kwa nini unafikiri kwamba ni suala vBET na inawezekana kwamba si.

Tafadhali kueleza jinsi ujumbe wako kwanza kuamua kuwa mtu kutumia vbenterprisetranslator_seo.php kuingiza XSCRIPTs ambayo ni kuandika juu. Tafadhali kumbuka kuwa vbenterprisetranslator_seo.php haina mantiki yoyote husika - ni Mdhibiti Front tu. Maombi yote kwenye jukwaa yako ni kwenda kwa faili hili na baada ya vbseo.php inayotumika. Hivyo kama wewe kuondoa sheria vBET, utaona kumbukumbu zote akizungumzia vbseo.php ambayo vbseo.php maana kwamba ni jukumu la mashambulizi.

Basi wakati huu nadhani kusoma kumbukumbu yako mbaya na vbenterprisetranslator_seo.php kwamba si kuwajibika kwa shambulio hilo. Naweza kuwa mbaya, lakini kama wewe ni uhakika, basi tafadhali kueleza jinsi ni kufanyika (hii insertion XSCRIPT na vbenterprisetranslator_seo.php) - sisi kuchanganua.

Tafadhali kumbuka - ni bora kwetu kuweka wateja wetu salama. Hivyo sisi kufanya juhudi zetu bora ya kutatua suala kama ni unasababishwa na vBET. Kwa usalama wako mwenyewe - tafadhali kueleza hasa nini unafikiri kwamba ni kufanyika kwa vBET. Vinginevyo kama wewe ni makosa - kile kutarajia, kwa sababu watu wengi wanadhani kila kitu ni kufanyika kwa vbenterprisetranslator_seo.php - ambayo tu mabadiliko vigezo server na hana kitu zaidi, lakini maombi yote kwenda kwa hilo, hivyo watu kupata hisia mbaya - hivyo kama wewe ni vibaya, basi utakuwa huru tu vBET yako yote cache na mazingira na wewe bado kushambuliwa, kwa sababu alifanya kitu kibaya (bado ushauri Disable vBET si kufuta).

Hivyo tafadhali kueleza kwa nini thinging kwamba vBET kuruhusiwa kwa shambulizi hili. Mpaka sasa uliandika tu kufikiri ni nini, lakini hakuna neno hufanya nini unafikiri kwamba.

[vBET]

Nina kosa unistalling VBET:
http://img822.imageshack.us/img822/273/errorunistalling.jpg
http://img337.imageshack.us/img337/4927/errorunistalling2.jpg

Kuhusu jambo la kwanza - nami heck yake.
Kuhusu 2 - wewe tu haja ya kuondoa kutoka files vBET server. Hasa / inajumuisha / xml / cpnav_vbenterprisetranslator.xml - moja amefafanua hii orodha vBET.

[mario06]

Yeye ni kutumia vbenterprisetranslator_seo.php kuingiza XSRIPT yake na tovuti yangu.

Wakati mimi kujaribu unistall bidhaa, na kufuta vbenterprisetranslator_seo.php kutoka server yangu mtandao wangu i dont kazi kwa sababu mahitaji "vbenterprisetranslator_seo.php" katika FTP: S

Jinsi gani naweza unistall "ALL" VBET?

Shukrani kwa ajili ya kujibu

UPDATE:
Nina kosa unistalling VBET:
http://img822.imageshack.us/img822/273/errorunistalling.jpg
http://img337.imageshack.us/img337/4927/errorunistalling2.jpg

Reinstall basi kujaribu uninstalling tena, basi manually futa zote vbet files uploaded katika utaratibu huu:

1. reinstall
2. kufuta
3. manually futa zote vbet uploaded files

PS. Michael, hii ni lazima kuangaliwa kwa undani zaidi kwa sababu nataka kulala salama usiku. :)

[vBET]

Kwa jambo la kwanza - ni ndogo vBET mdudu. Mimi tayari kupatikana ufumbuzi - itakuwa ni pamoja na katika taarifa yake ya pili. Kwa ajili ya kurekebisha haraka:
1. wazi vBET bidhaa faili: do-not-upload/product-vbenterprisetranslator.xml
2. Find:

$vbulletin->db->query_write('DROP TABLE ' . TABLE_PREFIX . 'vbenterprisetranslator_cache_'.$code.);
3. Nafasi na:

$vbulletin->db->query_write('DROP TABLE ' . TABLE_PREFIX . 'vbenterprisetranslator_cache_'.$code);
4. Kuagiza bidhaa faili tena
5. Sakinusha tena

Tafadhali kuondoa files vBET baada ya hapo. Kama kuondolewa tayari - tafadhali upload ni.

[vBET]

PS. Michael, hii ni lazima kuangaliwa kwa undani zaidi kwa sababu nataka kulala salama usiku. :)

Tafadhali angalia hapa na jibu kwa swali: http://www.vbenterprisetranslator.com/forum/troubleshooting/794-serverd-hacked-vbet.html # post3545

[vBET]

Hakuna majibu. Katika hali kama kitu anasema kuwa ni kosa na faili vBET ambayo aliitwa na hatia haina mantiki kwa ajili ya kizazi ukurasa hivyo insertion ya scripts haielekei hapo - ni haki mbele ya mtawala.

Suala la kufungwa.