Miami night club news from the source

Index page is fine. Continue about your business.

Night clubs, bars, and lounges.

Moderator: pod

Postby coach on Sat Mar 10, 2012 1:53 pm

Re: Index page is fine. Continue about your business.

As an interesting side/Dreamhost note. I found out the other day that Trend Micro, Inc. had me listed in their spammers blacklist. Now, Trend Micro has an F rating from the Better Business Bureau, so I don't know what business they have of rating anyone else, but that's kind of beside the point.

They said they had blacklisted my IP because of spammy activity. Well, I don't spam, and supposedly Dreamhost has these really strict spammy policies. But, I think it must be someone else on my shared server doing the spammy stuff, if I understand the IP address thing correctly.

I've been thinking about going in on a VPS, but I dunno. This is getting pretty annoying.
coach
 
Posts: 8243
Joined: Fri Oct 05, 2007 12:52 pm
Location: you have to ask

Postby TechJunkie on Sat Mar 10, 2012 1:56 pm

Re: Index page is fine. Continue about your business.

The che.php script that has been inserted into the Talk Nightlife account at least three times appears to me to be an email gateway designed to allow somebody to send email from our account by posting to the PHP file. You might have something similar running in your account.
User avatar
TechJunkie
Quartermaster
 
Posts: 7760
Joined: Fri Dec 14, 2007 4:57 pm
Location: 420 Lincoln Rd
Masters don't give orders;
they work with everybody else.
When the job is done, people are amazed
at what they have accomplished.

Postby coach on Sat Mar 10, 2012 1:58 pm

Re: Index page is fine. Continue about your business.

Also, I notice that only some of the avatars are broken. Fortunately, DannyD's still works.
coach
 
Posts: 8243
Joined: Fri Oct 05, 2007 12:52 pm
Location: you have to ask

Postby TechJunkie on Sat Mar 10, 2012 2:22 pm

Re: Index page is fine. Continue about your business.

That avatar problem should be fixed now. That was due to a hack yesterday. There were two more hacks since then.

Coach, this is what the email gateway script looks like: http://itproforum.ru/archive/index.php/t-591.html

You can scan your Dreamhost account for variations of that script by running this command from the root directory of your account on the server:

Code: Select all
grep -r 'function sendemail($from,$to,$subject,$message,$type){' *


If you get any file hits then you probably want to delete those files. Or rename them from whatever.php to whatever.php.bak. I see a lot of variants of that script all over the Internet, but the signature that the above command scans for is in all of them.

Also beware of a PHP file called "packer.php". It contains obfuscated malicious code.
User avatar
TechJunkie
Quartermaster
 
Posts: 7760
Joined: Fri Dec 14, 2007 4:57 pm
Location: 420 Lincoln Rd
Masters don't give orders;
they work with everybody else.
When the job is done, people are amazed
at what they have accomplished.

Postby coach on Sun Mar 11, 2012 12:03 pm

Re: Index page is fine. Continue about your business.

Awesome, thanks for the tip!
coach
 
Posts: 8243
Joined: Fri Oct 05, 2007 12:52 pm
Location: you have to ask

Postby coach on Wed May 02, 2012 9:58 pm

Re: Index page is fine. Continue about your business.

Jeez, you guys just got hacked again. While I was surfing right now. When I got here it was fine, now virus. I think it is the forum software that has been compromised. I was hosting a forum, just a small one, and it got so hacked, I think DH took it down or something. Or maybe ICANN did or something.
coach
 
Posts: 8243
Joined: Fri Oct 05, 2007 12:52 pm
Location: you have to ask

Postby pod on Thu May 03, 2012 1:29 am

Re: Index page is fine. Continue about your business.

I don't think it's phpBB. It's an issue with DH as we said.

That being said, Tech is obviously busy so just keep your shields up. Worst case scenario I'm prepared to export the DB and import it into something newer. It might seriously fuck up our Google rankings but it's not like we sell anything here. I'm more interested in keeping this community coherent than what a search engine thinks of us.
User avatar
pod
Bipolar Overlord
 
Posts: 24168
Joined: Fri Dec 14, 2007 5:35 pm
Location: miami

Postby Kamen on Thu May 24, 2012 6:10 pm

Re: Index page is fine. Continue about your business.

I just got a malicious URL notice on the index page.
Kamen
 
Posts: 1329
Joined: Sat Feb 16, 2008 8:36 pm

Previous

Return to talk about Nightlife

Who is online

Users browsing this forum: Bing [Bot], Google [Bot] and 2 guests