Re: My website had been hacked many times.

[Sovichea SOU <svch_sou@xxxxxxxxxxx>]

I already requested my hosting provider to check server log.

Well, I see other file. It is ironshell.php

Any more idea?


Thanks.

Vichea

On Sun, Jul 11, 2010 at 12:58 AM, Davide Baglieri <davidonzo@xxxxxxxxx>wrote:

> Not only the index file was modified, but some file has been uploaded
> to the server: http://elt.edu.kh/1.gif
>
> I just can success you to look the server logs and find when and how
> the file 1.gif has been uploaded to the server.
>
> On 10 July 2010 19:54, Sovichea SOU <svch_sou@xxxxxxxxxxx> wrote:
> > Here it is: elt.edu.kh
> > I rename hacked file to http://elt.edu.kh/index_old.htm
> >
> > Thanks.
> >
> >
> >
> > On Sun, Jul 11, 2010 at 12:50 AM, Davide Baglieri <davidonzo@xxxxxxxxx
> >wrote:
> >
> >>
> >>
> >> Can you link us the hacked website?
> >> There is any public upload form?
> >>
> >> Maybe someone upload a C99 shell.
> >>
> >>
> >>
>


[Non-text portions of this message have been removed]