random lines added to my main page: Hacked or not?

random lines added to my main page: Hacked or not?

by Adam Turner -
Number of replies: 5

Random single lines of text from webpages have appeared at the top of my main page.

http://hanyangowl.org/

Here are some examples:

I use a razr cadillac cts v parts how to is over a lot of the telephone camera.

Outstanding online sports flights to edinburgh from luton is available at this highly recommended sportsbook.

Our operators will be ready to take the moving company in nj requests right up to race jump.

was electronic trailer brake controller last day of DAILY SCHEDULED winter road reports.

These exotic car rental in las vegas can be downloaded to your PC and trasferred via bluetooth or cable direct to your PC.

My Moodle is externally hosted version 1.89 I believe. The links do not appear to go to be an attempt to direct to one site.

I need to use self-registration. The site is a collection of resources rather than a structured course. There does not appear to be any "profile porn", although I have identified some suspicious email self-registrations and deleted them in the past.

When I login the inserted text disappears from view. There are no files missing that I can see. My courses are intact. There does not appear to be any purposive human malicious hacking. I am not sure what happened. My Hosting provider says that it is not a problem on their end but they could just reinstall my moodle (to a more recent version as well.)

The PHP is too complex on the index page for me to recognize if anything has been added (hacked). I cannot recognize what page would handle the front page content. I only understand really basic HTML.

Any suggestions would really be appreciated on how to fix this problem or advice for a new install so it does not happen again as soon as possible.

Average of ratings: -
In reply to Adam Turner

Re: random lines added to my main page: Hacked or not?

by Howard Miller -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
Looks fine to me!
Average of ratings: -
In reply to Howard Miller

Re: random lines added to my main page: Hacked or not?

by Adam Turner -

Dear Howard,

The odd content only seems to appear if someone is not logged in, which most users will not be when using it. Once I login, the lines disappear.

What did you see when you first opened www.hanyangowl.org ?  before scrolling down?

Adam

Average of ratings: -
In reply to Adam Turner

Re: random lines added to my main page: Hacked or not?

by cor kuijt -
My bet is hacked. Open your index.php in an editor and look if there is unusual php code (encoded, base64) on top. Check your config.php also. Let me know.

Grtz,
Cor.
Average of ratings: -
In reply to cor kuijt

Re: random lines added to my main page: Hacked or not?

by Adam Turner -

I only have limited HTML skills and can't understand php code. Can you look briefly at the site  www.hanyangowl.org  and guess what kind of commands I should be looking for?

Adam Turner

Average of ratings: -
In reply to Adam Turner

Re: random lines added to my main page: Hacked or not?

by cor kuijt -
Hi Adam, sorry for my late reply.
You should download a part of your website and take a editor (like notepad or so). Look at the code from (lets say) index.php. Mostly, when hacked, there are lines of php added to your pages. They tent to hide the actual code by encoding it:

<?php
$str = 'code code enz';
echo base64_encode($str);
?>

This looks like: VGhpcyBpcyBhbiBlbmNvZGVkIHN0cmluZw.
Forget al the php code and search for encoded strings.
Average of ratings: -