Spam Abuse

[itsacoaster]

Hello TP folks,

I found out that it was possible my website was hacked.  A spamming PHP script found itself in my tp-images folder on my website.  I believe the file was named _system32.php.  I am just posting to see if there have been any other reports like this--or if it's only a coincidence that the bad script was in the tp-images folder.

Thanks everyone.

Edit:  there were actually four files, their names are below

index.php
phpsh.php
r57shell.php
_system32.php

One More Edit:  Doh, I forgot to tell you the version.  TP 0.98 and SMF 1.1.11

[G6Cad]

never seen a report of that  kind for the verision you use, mor likly it's something thats been uploaded through your downloadmodule at some time.

[Crip]

My Gmail / account / contacts....... was indeed hacked ... so i dunno?

[itsacoaster]

never seen a report of that  kind for the verision you use, mor likly it's something thats been uploaded through your downloadmodule at some time.

Thanks for the reply.  I think it's unlikely that someone uploaded it, since nothing has been uploaded lately and the problem appeared in the last month.  There was a good likelihood that it didn't have anything to do with TP at all.  I'll post back if I find out more.

[IchBin]

You should be able to have the host look to see when and how those scripts were put there. Let us know what you find out.

[Blue Steel]

if you've allowed people to upload .php files then your a nut. by default its not one of the default file types to accept.