Hacker Alert Notify

[vishal]

I received this email from panel. Is this of concern.
Any comments would be appreciated.

Thank you,
**************************************************
Note: If this is the first time you recieved this mail, it contains the history for the entire month so far.

Below are the recently upload scripts that contain code to send email. You may wish to inspect them to ensure they are not sending out SPAM.

/home/lucky/public_html/phpnuke/modules/Forums/functions.php:64: $alert_message = "HACKER ALERT NOTIFY \n A post inserted on your forums is a probable hacker attack. \n\n Post detail:\n $messageor \n\n $nukeurl \n\n POSTER IP ADRESS: $poster_ip \n\n Post Url: $nukeurl/modules.php?op=modload&name=Forums&file=viewtopic&topic=$topic_id&forum=$forum \n\n";
/home/lucky/public_html/phpnuke/modules/Forums/functions.php:65: mail($adminmail, $subject, $alert_message, "From: $adminmail\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/phpnuke/modules/Forums/functions.php:66:
---
/home/lucky/public_html/html/admin/modules/newsletter.php:122: while(list($user_email) = sql_fetch_row($result, $dbi)) {
/home/lucky/public_html/html/admin/modules/newsletter.php:123: mail($user_email, $subject, $content, "From: $from\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/html/admin/modules/newsletter.php:124: }
---
/home/lucky/public_html/html/admin/modules/newsletter.php:149: while(list($user_email) = sql_fetch_row($result, $dbi)) {
/home/lucky/public_html/html/admin/modules/newsletter.php:150: mail($user_email, $subject, $content, "From: $from\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/html/admin/modules/newsletter.php:151: }
---
/home/lucky/public_html/phpnuke/modules/Your_Account/index.php:118: $from="$adminmail";
/home/lucky/public_html/phpnuke/modules/Your_Account/index.php:119: mail($email, $subject, $message, "From: $from\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/phpnuke/modules/Your_Account/index.php:120: title("$sitename: "._USERREGLOGIN."");
---
/home/lucky/public_html/phpnuke/modules/Your_Account/index.php:547: $subject = ""._USERPASSWORD4." $uname";
/home/lucky/public_html/phpnuke/modules/Your_Account/index.php:548: mail($email, $subject, $message, "From: $adminmail\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/phpnuke/modules/Your_Account/index.php:549: /* Next step: add the new password to the database */
---
/home/lucky/public_html/phpnuke/modules/Your_Account/index.php:574: $subject=""._CODEFOR." $uname";
/home/lucky/public_html/phpnuke/modules/Your_Account/index.php:575: mail($email, $subject, $message, "From: $adminmail\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/phpnuke/modules/Your_Account/index.php:576: include ("header.php");
---
/home/lucky/public_html/phpnuke/modules/Forums/newtopic.php:326:
/home/lucky/public_html/phpnuke/modules/Forums/newtopic.php:327: mail($email, $subject, $message, "From: $from\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/phpnuke/modules/Forums/newtopic.php:328:
---
/home/lucky/public_html/modules/Forums/reply.php:151: // if (!$system)
/home/lucky/public_html/modules/Forums/reply.php:152: mail($m[email], $subject, $message, "From: $adminmail\r\nX-Mailer: phpNuke_forum");
/home/lucky/public_html/modules/Forums/reply.php:153:
---
/home/lucky/public_html/html/modules/Your_Account/index.php:145: $from = "$adminmail";
/home/lucky/public_html/html/modules/Your_Account/index.php:146: mail($user_email, $subject, $message, "From: $from\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/html/modules/Your_Account/index.php:147: title("$sitename: "._USERREGLOGIN."");
---
/home/lucky/public_html/html/modules/Your_Account/index.php:652: $subject = ""._USERPASSWORD4." $username";
/home/lucky/public_html/html/modules/Your_Account/index.php:653: mail($user_email, $subject, $message, "From: $adminmail\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/html/modules/Your_Account/index.php:654: /* Next step: add the new password to the database */
---
/home/lucky/public_html/html/modules/Your_Account/index.php:682: $subject=""._CODEFOR." $username";
/home/lucky/public_html/html/modules/Your_Account/index.php:683: mail($user_email, $subject, $message, "From: $adminmail\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/html/modules/Your_Account/index.php:684: include ("header.php");
---
/home/lucky/public_html/phpnuke/modules/Submit_News/index.php:240: $notify_message = "$notify_message\n\n\n========================================================\n$subject\n\n\n$story\n\n$storyext\n\n$name";
/home/lucky/public_html/phpnuke/modules/Submit_News/index.php:241: mail($notify_email, $notify_subject, $notify_message, "From: $notify_from\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/phpnuke/modules/Submit_News/index.php:242: }
---
/home/lucky/public_html/phpnuke/modules/Wysiwyg-editor/index.php:280: $notify_message = "$notify_message\n\n\n========================================================\n$subject\n\n\n$story\n\n$storyext\n\n$name";
/home/lucky/public_html/phpnuke/modules/Wysiwyg-editor/index.php:281: mail($notify_email, $notify_subject, $notify_message, "From: $notify_from\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/phpnuke/modules/Wysiwyg-editor/index.php:282: }
---
/home/lucky/public_html/phpnuke/modules/News/friend.php:60: $message = ""._HELLO." $fname:\n\n"._YOURFRIEND." $yname "._CONSIDERED."\n\n\n$title\n("._FDATE." $time)\n"._FTOPIC." $topictext\n\n"._URL.": $nukeurl/modules.php?name=$module_name&file=article&sid=$sid\n\n"._YOUCANREAD." $sitename\n$nukeurl";
/home/lucky/public_html/phpnuke/modules/News/friend.php:61: mail($fmail, $subject, $message, "From: \"$yname\" <$ymail>\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/phpnuke/modules/News/friend.php:62: $title = urlencode($title);
---
/home/lucky/public_html/html/modules/Submit_News/index.php:251: $notify_message = "$notify_message\n\n\n========================================================\n$subject\n\n\n$story\n\n$storyext\n\n$name";
/home/lucky/public_html/html/modules/Submit_News/index.php:252: mail($notify_email, $notify_subject, $notify_message, "From: $notify_from\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/html/modules/Submit_News/index.php:253: }
---
/home/lucky/public_html/html/modules/News/friend.php:76: $message = ""._HELLO." $fname:\n\n"._YOURFRIEND." $yname "._CONSIDERED."\n\n\n$title\n("._FDATE." $time)\n"._FTOPIC." $topictext\n\n"._URL.": $nukeurl/modules.php?name=$module_name&file=article&sid=$sid\n\n"._YOUCANREAD." $sitename\n$nukeurl";
/home/lucky/public_html/html/modules/News/friend.php:77: mail($fmail, $subject, $message, "From: \"$yname\" <$ymail>\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/html/modules/News/friend.php:78: $title = urlencode($title);
---
/home/lucky/public_html/phpnuke/modules/Recommend_Us/index.php:49: $message = ""._HELLO." $fname:\n\n"._YOURFRIEND." $yname "._OURSITE." $sitename "._INTSENT."\n\n\n"._FSITENAME." $sitename\n$slogan\n"._FSITEURL." $nukeurl\n";
/home/lucky/public_html/phpnuke/modules/Recommend_Us/index.php:50: mail($fmail, $subject, $message, "From: \"$yname\" <$ymail>\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/phpnuke/modules/Recommend_Us/index.php:51: Header("Location: modules.php?name=$module_name&op=SiteSent&fname=$fname");
---
/home/lucky/public_html/modules/News/friend.php:60: $message = ""._HELLO." $fname:\n\n"._YOURFRIEND." $yname "._CONSIDERED."\n\n\n$title\n("._FDATE." $time)\n"._FTOPIC." $topictext\n\n"._URL.": $nukeurl/modules.php?name=$module_name&file=article&sid=$sid\n\n"._YOUCANREAD." $sitename\n$nukeurl";
/home/lucky/public_html/modules/News/friend.php:61: mail($fmail, $subject, $message, "From: \"$yname\" <$ymail>\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/modules/News/friend.php:62: $title = urlencode($title);
---
/home/lucky/public_html/modules/Feedback/index.php:78: $mailheaders .= "Reply-To: $sender_email\n\n";
/home/lucky/public_html/modules/Feedback/index.php:79: mail($to, $subject, $msg, $mailheaders);
/home/lucky/public_html/modules/Feedback/index.php:80: echo "<P><center>"._FBMAILSENT."</center></p>";
---
/home/lucky/public_html/phpnuke/modules/WebMail/libmail.php:21: /*
/home/lucky/public_html/phpnuke/modules/WebMail/libmail.php:22: this class encapsulates the PHP mail() function.
/home/lucky/public_html/phpnuke/modules/WebMail/libmail.php:23: implements CC, Bcc, Priority headers
---
/home/lucky/public_html/html/banners.php:81: $subject = "$sitename: "._BANNERSFINNISHED."";
/home/lucky/public_html/html/banners.php:82: mail($to, $subject, $message, "From: $from\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/html/banners.php:83: }
---
/home/lucky/public_html/html/banners.php:327: $from = "$sitename";
/home/lucky/public_html/html/banners.php:328: mail($email, $subject, $message, "From: $from\nX-Mailer: PHP/" . phpversion());
/home/lucky/public_html/html/banners.php:329: echo "
---
/home/lucky/public_html/phpnuke/modules/Forums/reply.php:151: // if (!$system)
/home/lucky/public_html/phpnuke/modules/Forums/reply.php:152: mail($m[email], $subject, $message, "From: $adminmail\r\nX-Mailer: phpNuke_forum");
/home/lucky/public_html/phpnuke/modules/Forums/reply.php:153:
---
/home/lucky/public_html/phpnuke/modules/Feedback/index.php:78: $mailheaders .= "Reply-To: $sender_email\n\n";
/home/lucky/public_html/phpnuke/modules/Feedback/index.php:79: mail($to, $subject, $msg, $mailheaders);
/home/lucky/public_html/phpnuke/modules/Feedback/index.php:80: echo "<P><center>"._FBMAILSENT."</center></p>";
---

[Markwaugh]

are you getting the same message in other cpanels ?? i mean other accounts in the same server?? did you login to ssh ? where exactly you get this message in cpanel ?

[MPCN_Russ1]

vishal,
No this is not of any concern. The email that you received above is stating that a client recently uploaded PHP or CGI Scripts of which send email. The "HACKER ALERT NOTIFY" that you saw was an Email Alert that that client will be sent from PHPNuke upon a person attempting todo an exploit. The reason cpanel sends those emails (as well as stated in that email) is because it is a feature to help prevent spam on a cpanel server. The notification being for you to make sure that the scripts that were uploaded are NOT to produce spam

Thanks,
Russ