Stange Error Log. Hacked Site?

Discussion in 'Security' started by adcents, Jul 19, 2008.

  1. #1
    My site was hacked before, but I thought I cleaned it all up. The error log makes me think somebody still has access. Any ideas?

     
    adcents, Jul 19, 2008 IP
  2. SteveWh

    SteveWh Member

    Messages:
    74
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    48
    #2
    Is the file vdimgck.php one that you installed on the site yourself, or is that name unknown to you?

    Did you recently change the ErrorDocument line in your .htaccess file? That error is self-explanatory: you can't specify the 401 error document using a full URL. It must be a local path to the file.

    The error messages refer to two different versions of PHP. Which version do you actually use?

    Did you or your host change the PHP version or its configuration on your server recently?

    Do you use a variable called executor_globals, or is that mysterious to you?

    Is your site protected against Remote File Inclusion? Depending on the answers to the above questions, I'm wondering if maybe somebody successfully got a remote PHP script to run on your site, but it's trying to do things that your site or version of PHP doesn't support.

    Check your site access logs, and try to match up the requests shown there with the error log errors that occurred at the same times. The types of requests you see will help determine whether those requests were intentionally malicious or if they are accidentally making apparent some sort of misconfiguration on your server.
     
    SteveWh, Jul 19, 2008 IP
  3. Yousif

    Yousif Banned

    Messages:
    233
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Hmm, it looks like the installation is corrupt itself or not configured properly. This doesn't seem to be a intrusion, rather many HTTP requests to the web application. Since you said your website was hacked before, do you now consider securing it? I specialize in web application security and penetration testing. Logs mean nothing w/out a thorough review. PM me if you are looking into securing your website/server.
     
    Yousif, Jul 19, 2008 IP