Recent Topics
  1. b2evolution CMS Support Forums
  2. b2evolution Support
  3. General Support
  4. [2.x] Website hacked

[2.x] Website hacked

1 Jan 07, 2011 05:07    

My b2evolution Version: 2.x

Yesterday my website got hacked again with JS:Illredir-cj

Website
http://www.posbrowser.com.au/b2evolution.new/blogs/index.php?blog=1

What I did was download the whole site, then scan it with AVAST. It found that in the directory, many files were infected.

I replaced them with copies of the file that came from a non-infected version that I created when I first uploaded the site. I tested these files first.

I then downloaded the site again and tested them and no Trojans.

I checked the properties of these two files and they are 644, I also checked quite a file other files and directories and they look fine here too.

Today I tested the site, and it was infected.

http://www.posbrowser.com.au/b2evolution.new/blogs
default.php
index.php

Then I uploaded these files as above.

Now what was strange is that default.php was not even on the website then. I do not think that default.php is used by b2evolution.

Any ideas what to do?

Back to top

2 Jan 07, 2011 12:18

bernard zimmermann wrote:

My b2evolution Version: 2.x

Yesterday my website got hacked again with JS:Illredir-cj

Website
http://www.posbrowser.com.au/b2evolution.new/blogs/index.php?blog=1
[...]
Any ideas what to do?

1) Update/upgrade to the newest b2evolution release. When I recommend b2evolution in Twitter or elsewhere, I emphasize security feature as inherent strength.

2) Consider another hosting provider for your blog. Quickly perfoming:

nslookup www.posbrowser.com.au

Non-authoritative answer:
www.posbrowser.com.au canonical name = posbrowser.com.au.
Name: posbrowser.com.au
Address: 209.200.249.149

And performing a WHOIS on IP above tells us that you are with Lunar Pages -possibly in a shared environment.

You may be the victim of a "collateral infection" -for example if another hosted instance (or more) are infected. It is not uncommon that hosted peers attack one another. In certain occasions, I've have had to permanently block IPs in a given IP block due to vicious unauthorized SSH entry attempts.

If you are comfortable with an virtual machine instance in the cloud, say Amazon EC2, you may want to migrate there since they are offering a free one year trial of a micro-instance (some 10Gb virtual storage & half a Gig of RAM for your operating system and supporting apps like your blog).

Or any other provider.

Best Professional Regards.

Back to top

3 Jan 19, 2011 02:58

What would happen was I would updated the site and so clear out the virus but it kept coming back. Parts of the virus were in directories that a user cannot get into. Making me suspect that the virus owner was no user.

I finally changed the FTP password and the virus stopped.

This is very strange as I have been very careful with the FTP password. It used a random combination of upper and lower case letters and numbers. This is it bVGcnIW8qkaEp7. No one could have brute forced that one. So it must have been stolen.

Back to top


Form is loading...