Index page is fine. Continue about your business.

As an interesting side/Dreamhost note. I found out the other day that Trend Micro, Inc. had me listed in their spammers blacklist. Now, Trend Micro has an F rating from the Better Business Bureau, so I don't know what business they have of rating anyone else, but that's kind of beside the point.

They said they had blacklisted my IP because of spammy activity. Well, I don't spam, and supposedly Dreamhost has these really strict spammy policies. But, I think it must be someone else on my shared server doing the spammy stuff, if I understand the IP address thing correctly.

I've been thinking about going in on a VPS, but I dunno. This is getting pretty annoying.

The che.php script that has been inserted into the Talk Nightlife account at least three times appears to me to be an email gateway designed to allow somebody to send email from our account by posting to the PHP file. You might have something similar running in your account.

Also, I notice that only some of the avatars are broken. Fortunately, DannyD's still works.

That avatar problem should be fixed now. That was due to a hack yesterday. There were two more hacks since then.

Coach, this is what the email gateway script looks like: http://itproforum.ru/archive/index.php/t-591.html

You can scan your Dreamhost account for variations of that script by running this command from the root directory of your account on the server:

Code: Select all

grep -r 'function sendemail($from,$to,$subject,$message,$type){' *


If you get any file hits then you probably want to delete those files. Or rename them from whatever.php to whatever.php.bak. I see a lot of variants of that script all over the Internet, but the signature that the above command scans for is in all of them.

Also beware of a PHP file called "packer.php". It contains obfuscated malicious code.

Awesome, thanks for the tip!

Jeez, you guys just got hacked again. While I was surfing right now. When I got here it was fine, now virus. I think it is the forum software that has been compromised. I was hosting a forum, just a small one, and it got so hacked, I think DH took it down or something. Or maybe ICANN did or something.

I don't think it's phpBB. It's an issue with DH as we said.

That being said, Tech is obviously busy so just keep your shields up. Worst case scenario I'm prepared to export the DB and import it into something newer. It might seriously fuck up our Google rankings but it's not like we sell anything here. I'm more interested in keeping this community coherent than what a search engine thinks of us.

I just got a malicious URL notice on the index page.