[help] Have I been hacked?

Several subdomains from my website are not working as they should anymore. On several pages some very weird code started to appear. I have this in pretty much all the wordpress blogs (except 1) running on my website, and on my vBulletin 3.5 board. The code that appeared in one of those .php files looks like the one I attached in probleem.txt. The problem does not appear in HTML files, only in PHP files so far.. It also happened two times so far that there was a popup with porn in when I tried to open those subdomains, but that can also be a virus on my computer.

Anyone has any idea?

probleem.txt

Attachment: probleem.txt

#332841

It looks like you may have been hacked.

Because some of the string are encoded.

Here have a look here someones actually decoded the exact information you provided in your

in your text file. maybe this can shed some light on it.

http://www.ibproarcade.com/index.php?showt...t=0entry47594

Hope this helps good luck.

#332860

yes. all your login data was send to this adress:

http://bis.iframe.ru/master.php?r_addr=

just extracted line 8 from the skript you posted and did this:

<?php

echo base64_decode("aHR0cDovL2Jpcy5pZnJhbWUucnUvbWFzdGVyLnBocD9yX2FkZHI9");

?>

also in line 10 there is a backdoor included, so if I call your site with

http:///yoursite.com/foobar.php?a3kfj39fsj2=SYSTEMCOMMAND

the GET-Variable a3kfj39fsj2 can include a system command which php can execute, which means the attacer can do pretty much everything on your system.

you should shut down your site now and basically reinstall everything, get new passwords.

#332861

ouch man that is harsh....

#332902

Okay, I looked at it again. It doesn't seem so bad. Actually this doesn't work with wordpress 1.51 or vbulletin 3.5, but and thats whats bothering me and is very brilliant about this hack. If it is true, and your host allows executing the system()-command through php they can do pretty much everything on the hosting machine, which means the hack can also have been introduced by someone else on the server. Inform your host about this too.

#332954