New Zenner
- Join Date:
- Nov 2008
- Posts:
- 8
- Plugin Contributions:
- 0
Exploit related scripts reported - Lunarpages
Hi there,
Looks like I have picked up a problem.
Below is an e-mail I received from the company hosting my ZenCart system.
First off some info on my installation you might require:
v1.3.8 [2008-11-02 05:49:36] (Fresh Installation)
Server OS: Linux 2.6.9-89.0.16.ELsmp
PHP Version: 4.4.9 (Zend: 1.3.0)
Database: MySQL 5.0.67-community
Please help, what do I do now?
Dear JC Fourie,
A technician responded to your ticket with:
Hello,
During a routine monitoring on our servers we have found that your account was running exploit related scripts :
germa10 16784 0.0 0.1 16188 6024 ? S 10:43 0:00 /usr/bin/php /home/germa10/public_html/naturesown/ZenCart/Cart//images/wp-comments2.php
germa10 16793 0.0 0.0 0 0 ? Z 10:43 0:00 [sh]
germa10 16803 0.0 0.0 6152 3064 ? S 10:43 0:00 httpds
Looking further into this, we were able to find that several exploit related scripts have been placed into /home/germa10/public_html/naturesown/ZenCart/Cart//images :
-rwxrwxrwx 1 germa10 germa10 2903 Nov 26 10:50 noskinoskieskimoski.php
-rwxrwxrwx 1 germa10 germa10 66 Nov 9 18:26 omaster.php
-rwxrwxrwx 1 germa10 germa10 110 Aug 31 07:34 pb.php
-rw-r--r-- 1 germa10 germa10 43 Nov 2 2008 pixel_trans.gif
-rwxrwxrwx 1 germa10 germa10 672 Sep 27 08:15 ptc.php
-rw-r--r-- 1 germa10 germa10 2418 Nov 2 2008 sample_image.gif
drwxr-xr-x 2 germa10 germa10 4096 Nov 2 2008 samples
-rwxrwxrwx 1 germa10 germa10 568 Sep 24 13:41 se.php
-rwxrwxrwx 1 germa10 germa10 597 Sep 22 10:17 sexxx.php
drwxr-xr-x 2 germa10 germa10 4096 Nov 2 2008 sierra
-rw-r--r-- 1 germa10 germa10 5944 Nov 2 2008 small_00.jpg
-rwxrwxrwx 1 germa10 germa10 9589 Mar 8 2009 solgar.jpg
-rw-r--r-- 1 germa10 germa10 9480 Nov 2 2008 sooty.jpg
-rw-r--r-- 1 germa10 germa10 16498 Nov 2 2008 test_demo.jpg
-rwxrwxrwx 1 germa10 germa10 63 Oct 28 04:44 toti.php
drwxr-xr-x 2 germa10 germa10 4096 Nov 2 2008 uploads
-rwxrwxrwx 1 germa10 germa10 89 Sep 10 05:13 vooo.php
-rw-r--r-- 1 germa10 germa10 4754 Nov 2 2008 waybkgnd.gif
-rwxrwxrwx 1 germa10 germa10 17287 Apr 20 2009 willow_cream.jpg
-rwxrwxrwx 1 germa10 germa10 2803 Nov 30 10:54 wp-comments2.php
-rwxrwxrwx 1 germa10 germa10 21 Oct 22 18:54 yjgqbw.php
As a result, the folder has been disabled by means of chmod 000 and chown root:root and all the processes running under your username were killed. Please kindly update your ZenCart installation / apply the latest security patches and change all the passwords on the account. Please also audit the folder mentioned above and removed the malicious components placed in it. Thank you for your cooperation regarding this matter !
Kind Regards,
Margarit Mugurel
Junior System Admin I - System Administrator Team
Support and Assistance:
Help Desk - https://support.lunarpages.com/
Membership Forum - http://www.lunarforums.com/
Tutorials - http://www.lunarpages.com/tutorials/
Phones:
U.S. & International - 1-714-521-8150
Additionally, you may also view the entire ticket by visiting: http://support.lunarpages.com/tickets/view/1673261
Your ticket ID is 1673261.
Lunarpages Web Hosting Helpdesk
https://support.lunarpages.com
