coppermine-gallery.com/forum

Support => cpg1.4.x Support => Older/other versions => cpg1.4 miscellaneous => Topic started by: artpapa on February 20, 2009, 11:09:06 AM

Title: All my images points to different address! possible hacker attack?
Post by: artpapa on February 20, 2009, 11:09:06 AM
Hi. I had weird problem happens , somehow addresses of my images has been changed, instead the my gallery domain http://www.antonovart.com/gallery/  they are  start pointing to the http://www.google.com/gallery/.
I didn't change anything for a long time,  this is happened just couple days ago.
I don't know what to think, maybe   possible hacker attack?
Please help me where to look at!
He is the link with disappeared images: http://www.antonovart.com/gallery/
Title: Re: All my images points to different address! possible hacker attack?
Post by: Ludo on February 20, 2009, 11:43:54 AM
Check your Coppermine URL under Configuration > General settings
Title: Re: All my images points to different address! possible hacker attack?
Post by: artpapa on February 20, 2009, 12:23:08 PM
Quote from: Ludo on February 20, 2009, 11:43:54 AM
Check your Coppermine URL under Configuration > General settings
URL under Configuration > General settings is normal:   http://antonovart.com/gallery/
Title: Re: All my images points to different address! possible hacker attack?
Post by: persianprince on February 21, 2009, 02:38:04 AM
Your gallery has been compromised.

In your /albums folder, you will have a .htaccess file which is redirecting all your images to Google.com.

Title: Re: All my images points to different address! possible hacker attack?
Post by: Fabricio Ferrero on February 21, 2009, 05:20:13 AM
Yes, an existing .htaccess file it might be the reason of your problem. Anyways, update! If don't you are in risk to be hacked.
Title: Re: All my images points to different address! possible hacker attack?
Post by: artpapa on February 21, 2009, 08:57:49 AM
think you guys very much!
should I just delete this file?
Title: Re: All my images points to different address! possible hacker attack?
Post by: McKenzie on February 21, 2009, 03:28:11 PM
What is written in that file? If there is only the forwarding to gooale gallery you can delete it.
Title: Re: All my images points to different address! possible hacker attack?
Post by: Joachim Müller on February 25, 2009, 08:57:42 AM
You already have been hacked. There's no saying if the payload in the .htaccess file is all that the malevolent script kid has left behind. You need to sanitize your entire webspace as suggested in the thread "Yikes, I've been hacked! Now what? (http://forum.coppermine-gallery.net/index.php/topic,51927.0.html)". Don't take this lightheartedly, this is serious.