ConfigServer Community Forum

Hi folks, I've just started observing a relatively new format for the gzinflate/base64 hacks, now starting with: <?php $D=strrev('edoced_46esab');$s=gzinflate Here is a picture snippet of a hack I observed this past week, which CXS does not pick up as a hack (when it should have). It's a pretty egre...

Hi, So are there general recommendations for these two settings? CONNLIMIT = PORTFLOOD = We have not used them in the past though are considering applying them on servers we've seen more aggressive connections recently. Safe settings that generally work well in a shared server environment recommende...

Wow, I'm amazed you folks haven't thought of this. With the increased used of mobile devices, clients are deleting or moving email to trash within accounts, then have no clue how to empty the trash (creating a lot of customer service time wastage). So... What do you think about adding these two opti...

Excellent! Thank you. -Jim

I'm really liking this latest subject format!
cxs Scan on username (Hits:1084) (Viruses:0) (Fingerprints:0)

Thanks,
Jim

Hi folks, Ok, we've found clients with the usual c99 shell scripts installed and the thought occurred to me below. Could CXS be set to either append this text to existing .htaccess files or add an .htaccess file to directories where obvious shell scripts have been located? Addhandler text/plain .pl ...

Got it.
Wouldn't that chain of characters have to be:
Undefined index: pin
?

Which as far as I can tell would only be found in this specific error log file used for this specific type of phishing script.

Thanks,
Jim

This actually worked:
regall:Undefined index: pin

with result:
# Regular expression match = [Undefined index: pin]:
'/home/webhost/public_html/images/ucon/error_log'

One of the common phishing installer scripts creates a log file named: error_log (and FYI purposes other filenames in this phishing installer are login.php, regions.zip and index.htm) In this log file the one thing I believe could be ID's as a likely hack would be this line: [26-Feb-2010 16:12:02] ...

One of the common phishing installer scripts creates a log file named: error_log (and FYI purposes other filenames in this phishing installer are login.php, regions.zip and index.htm) In this log file the one thing I believe could be ID's as a likely hack would be this line: [26-Feb-2010 16:12:02] P...