 |
|
|
Mod Options |
|
#1
15 Sep 2006, 22:13
|
||||
|
||||
|
Having issues with hackers
I am having an issue with a hacker dupming files in my forum root
I keep finding these core.4967 core.21142 core.24723 core.16640 core.32086 core.24428 core.15133 and among another bunch every day Running 3.6, and have .htaccess in all directories now. It is driving me nuts as these guys are f ing up my server. Got any ideas? No members have liked this post.
|
| Comments |
|
#2
15 Sep 2006, 23:22
|
||||
|
||||
|
is it a shared server?
talk to hosting company / server admins, see if they're having issues on their end
__________________
Admin of the Corsair Memory Forum (AKA the House of Help from back in the day) Admin of Petri's IT Forum / Moderator at webdesignforums.net No members have liked this post.
|
|
#3
15 Sep 2006, 23:24
|
||||
|
||||
|
What are in the files?
__________________
Sci-Fi Forum / The Walking Dead & Horror Forum / CinVin
(Sorry, but I am no longer developing for vB; please do not PM. So long, and thanks for all the fish.) No members have liked this post.
|
|
#4
15 Sep 2006, 23:38
|
||||
|
||||
|
and what size are the files?
__________________
Admin of the Corsair Memory Forum (AKA the House of Help from back in the day) Admin of Petri's IT Forum / Moderator at webdesignforums.net No members have liked this post.
|
|
#5
15 Sep 2006, 23:51
|
|||
|
|||
|
What's your kernel version?
No members have liked this post.
|
|
#6
16 Sep 2006, 00:49
|
|||
|
|||
|
what makes you think its hackers? Are you on hostdime?
No members have liked this post.
|
|
#7
16 Sep 2006, 17:06
|
||||
|
||||
|
If it were real hackes,your site would be dead right now.Even I can do that
__________________
My free mods~click here No members have liked this post.
|
|
#8
17 Sep 2006, 04:13
|
||||
|
||||
|
Originally Posted by KW802
Ok so the files are so large I cannot copy the info.
38572 k in total each, and they are the same size each, all done by the same person from what I can imagine. I just want to find out who and fix it so they cannot dp this anymore. What a waste of my time. Here is a blurb from the file and as you can see it is all junk, I find when I scroll down lower it has a key logger script in the program. My question is how do I shut this crap down without loosing my board? core.8711 File Type: ELF 32-bit LSB core file Intel 80386, version 1 (SYSV), SVR4-style, from 'php' -------------------------------------------------------------------------------- ELF44 k @ P @&@(PP+[email protected],`2` 5pP<p< Mp@[email protected]@ЀPPP ``P kPPpp pŀ p@@0P배p0 @ 0004 9FF[email protected] B N[email protected]@0OPB0O B@O B@O BPOgBPOjB00Oj[email protected] O xB [email protected]P [CPPp\CP\CP\CPPoCPoC00[email protected] 0QoC 0Q oC PQoCPQqC pQ0rCpQ sCQPsCQ0tC QPtC Q CQC QC RC0R CRCpRC R0C RC0R0C`0RC@RC @RCPPR0C``R[email protected]RCpp`SC0`SCpSCpSC SCpS`C SC0 SC[email protected]CPSC SCpp@[email protected]C@V C `VpCP`VCPPV0C0V`C00W0KD WPLD XpLD XyD XyD0X D0X D@XPD0@XD `XD0`XDpX`pX`Y` ZxZxxxPtdHZH$$CORE"M{{04MF""" oC4{{3'[Cs {|CORER%~&~"M{{php/usr/bin/php cron.php COREtx ށ~N; +G&+#YQ̘̘̐̀\B\B82"" T T 0"`"`8{{+N+@@ G(i O +N+n+KG^0?@8 %~%~%~%~&~&~&~&~xN = =7[email protected]@ phpech߷5f`&-(3 93s,{ ?8nn @@6jS44 +N++N++N+ޘCOREd4 T %~ %~ &~&~lCORE 93s,{ ?8nn @+FLINUX 93s,{ ?8nn @EẺEEu|$U}D$t$ D$u|$L$ 4$P~ Ufzt4EE}v8M 9E;Et$Eăl[^_]zfur UT$4$xtM|IMt <$UT$YxB44$M9t<u+V$Hu 4$ M|0}u2E3|$MU uEȉL$T$ t$$#xEEu 08ZuE}"UVS[R p@Ћu[^US[# PY[gethostby*.getanswer: asked for "%s", got "%s"0123456789abcdefgethostby*.getanswer: asked for "%s %s %s", got type "%s"%u.%u.%u.%u.in-addr.arpa%02hhx0.%u.%u.%u.in-addr.arpa0.0.%u.%u.in-addr.arpa0.0.0.%u.in-addr.arpa/lib/ld-linux.so.26EO 1TT _8o oo oo6o@CC W_COm[C;cCPUcCSC `C> ^C0SCn xjC EC6jC BcC0LC p5jC. > WcC^ n C x`^: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)libnss_dns-2.3.4.so.debugD+.symtab.strtab.shstrtab.note.ABI-tag.hash.dynsym.dynstr.gnu.version.gnu.version_d.gnu.version_r.rel.dyn.rel.plt.i nit.text.fini.rodata.interp.eh_frame.ctors.dtors.jcr.dynamic.got.got.plt.data.bs s.comment.gnu_debuglink44 ) No members have liked this post.
|
|
#9
19 Sep 2006, 15:57
|
|||
|
|||
|
I doubt that you are being hacked. Those are probably core dumps from an unstable process.
What is the result of running 'ulimit -c'? No members have liked this post.
|
|
#10
19 Sep 2006, 20:58
|
|||
|
|||
|
They are core dumps. Are you on host dime or a vps?
No members have liked this post.
|
|
«
Previous Mod
|
Next Mod
»
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Mod Options | |
|
|
| New To Site? | Need Help? |
All times are GMT. The time now is 12:59.