Anyone Using open source PHP scripts, check your files

[headbanging]

I have a few websites that operate using open source php coding, and there has just been the latest round of hacking.

It's the eval(base64_decode and it places extra coding at the very top of all your PHP files.

So if anyone runs a site, using open source php, open the files, and if at the very top it starts with eval(base64_decode then a load of numbers and letters, you need to decode that and find where the files are hidden, delete these, restore all files, rename some directories etc.

If you need more advice, let me know, and i can give you some links.

Thanks

Drew


PS. Yes I did get done myself. Gonna be a loooonnnngggg night tonight

[domino]

I work for a webhosting company - I'm on of the engineers.

I feel your pain. This plagued us all of last week and was an absolute nightmare. Good luck getting it all fixed