Possible attack on my Gallery !!!

[batu544]

Hi,
     I don't know whether someone has just cracked into my gallery or not, but today suddenly found 2 new folders has been created and some php files are out there ..Could anyone please look into this php file and let me know what exactly its trying to do..

Code: [Select]

REMOVED

Also, I found a file called error_log and the content on this is..

Code: [Select]

[04-Apr-2010 06:07:03] PHP Warning:  fopen() [<a href='function.fopen'>function.fopen</a>]: URL file-access is disabled in the server configuration in /home/xxxxxxx/public_html/ulmml/pkh.php on line 373
[04-Apr-2010 06:07:03] PHP Warning:  fopen(http://safechecker2.net/w.txt) [<a href='function.fopen'>function.fopen</a>]: failed to open stream: no suitable wrapper could be found in /home/xxxxxx/public_html/ulmml/pkh.php on line 373
[04-Apr-2010 06:07:03] PHP Warning:  feof(): supplied argument is not a valid stream resource in /home/xxxxxxx/public_html/ulmml/pkh.php on line 375
[04-Apr-2010 06:07:03] PHP Warning:  fgets(): supplied argument is not a valid stream resource in /home/xxxxxxx/public_html/ulmml/pkh.php on line 377
[04-Apr-2010 06:07:03] PHP Warning:  fclose(): supplied argument is not a valid stream resource in /home/xxxxxxx/public_html/ulmml/pkh.php on line 381



If anyone can let us know what type of attack is this and how can I stop it in future , then it would be a great help..!!

Thanks,
batu544

edit: replaced the folder name with xxxxxx

[V@no]

It's a trojan. Can be used to read files on your server, upload and execute additional files.

It is always hard to tell how it got onto a server, it could be through and unpached/unknown hole in 4images or through other hole on server itself or other scripts you are using...

Remove anything suspicious and also check .htaccess files.

P.S.
I've removed code from your post for security reasons.

[batu544]

Thanks V@no.. for providing this information..
 
   No idea how it happened and I checked all the files and .htaccess file also.. everything looks okay to me..


Is there anyway to stop execution of php scripts other than 4image related php file ?


Thanks,
batu544