<?php(with the actual content, i.e. the stuff displayed as xxx filled with actual db details) and maybe the additional line
// Coppermine configuration file
// MySQL configuration
$CONFIG['dbserver'] = 'xxx'; // Your databaseserver
$CONFIG['dbuser'] = 'xxx'; // Your mysql username
$CONFIG['dbpass'] = 'xxx'; // Your mysql password
$CONFIG['dbname'] = 'xxx'; // Your mysql database name
// MySQL TABLE NAMES PREFIX
$CONFIG['TABLE_PREFIX'] = 'xxxx';
?>
define('SILLY_SAFE_MODE', 1);Everything else that maybe exists in that file is malevolent code and should be deleted. Do not delete the entire file, but only clean the contents if there is malicious code within that file.Steps in attempting to identify a potential threat and/or embedded malware.
First and foremost, a few things bear repeating: You, as a webmaster, regardless of skill level, are responsible for your website, and responsible for the safe passage of visitors to and from your web space. You are responsible for maintaining a safe environment, which means, but by no means is limited to, keeping whatever applications/scripts/programs you have running (or available) as up-to-date as possible. Do not expect your web host, a volunteer or anyone else to come to your rescue should disaster strike. A good webmaster understands these basic principles and takes steps towards that end.
These steps include keeping all scripts up-to-date by regularly visiting that programs homepage and/or support forum and subscribing to their newsletter (if applicable). These steps include setting proper permissions on files and directories. These steps include removing old or unused scripts from the web space (or removing read/write access to these scripts if they are necessary for documentation purposes). These steps include backing-up. It cannot be stressed enough how important it is to regularly back-up your files. While it can be very time consuming to fully back-up your web space, consider the alternative -- being directed to this thread overwhelmed with fear, frustration, anxiety, stress and confusion. Weighing these, backing up really isn't that bad after all! And in some cases, may be your only recourse in reviving a site that's been infected with malware, etc.
The above topics have been covered within this Yikes thread. This post deals with actually identifying a (hidden or otherwise) threat that's embedded in your web space. The webmaster, of course, has (or should have) full and complete access to the servers file and directory structure. As a site visitor, options are much more limited and restricting. Still, there are available tools to help identify potential threats. Some are outlined below:
- Unmask Parasites (http://www.unmaskparasites.com/): Scans entered website seeking embedded malware, known signatures and potential unsafe links and redirects.
- Norton Safe Web (http://safeweb.norton.com/): Similar to above, however relies on cached results based upon prior automated scanning. Also allows comments from registered users, which can prove helpful.
- Google Safe Browsing Diagnostic (http://www.google.com/safebrowsing/diagnostic?site=ENTER_DOMAIN): Cached results of malware scanning.
- McAfee Site Adviser (http://www.siteadvisor.com/): Uses a cached database to display results of previously scanned websites.
Trend Micro Web Reputation Search (https://qa.securecloud.com/reputation/query?locale=en-US): Similar to Norton Safe Web and uses cached results.- Virus Total (http://www.virustotal.com/)*: Virus Total is a service that analyzes suspicious files and facilitates the quick detection of viruses, worms, Trojans, and all kinds of malware detected by anti-virus engines. Works in real-time as well as cached results. *Note however, this tool is best suited for webmasters in most cases.
In addition, an excellent supplemental article to this Yikes thread, and a generally informative outline regarding repairing an infected website can be found here: How to prevent your site from getting hacked. How to repair a damaged site. Website security precautions. (http://25yearsofprogramming.com/blog/20070705.htm) Extremely large galleries with many hundreds or thousands of files and folders may benefit from utilizing cron to list all the files in your (Linux) website (http://25yearsofprogramming.com/blog/2009/20090621.htm), where the output may be visually inspected to verify no rogue files/folders and their permissions.
Important: Before attempting to resolve a website issue, it is imperative that you first activate the anti-virus program of your choice and update it to the latest definitions. Activate your backup anti-malware program (such as Malware Bytes and/or SpyBot Search & Destroy's IE Resident -- if applicable) and fully scan your computer to identify and resolve threats there before accessing an infected website. It makes no sense to cleanse a website of an infection that your own PC may re-infect upon access. Resolve your PC issue(s) first, then move onto your website issue. After successful scanning of your virus-free computer, and using each of the tools listed above, carefully scan the infected website.
As a visitor, I begin with Unmask Parasites, a scanner that uses both cached results from previous scans as well as real-time scanning to identify possible threats and suspicious links (to known malware sites). The scanner will display results as well as potential suspicious links and scripts. Viewing the source code of a given page will accomplish some of what Unmask Parasites accomplishes, but doesn't "red flag" anything. A supporter or helper has no way of knowing what external links are legitimate and what external links are problematic. Unmask Parasites (as well as the rest of the tools) will highlight these for you for later review -- or in some cases -- provide an in-depth explanation of the type of risk identified. Or both. Note any suspicious links or scripts and rescan again using the rest of the above tools. Upon scan completion, we should now have a pretty good idea of where to begin. Compile the list of suspicious items and head to your favorite search engine and begin the process of identifying each suspicious link and script.
Armed with whatever knowledge learned from searching, begin the process of removing potential threats.
Identify the obvious first, if possible. Visually inspect the directory structure in question (and in some respects, in general) and scan for blatantly obvious files and/or folders that aren't part of the Coppermine directory structure. Coppermine utilizes a meta-redirect within index.php files, so unless the webmaster has explicitly added them, there should be no .htaccess files; especially under the /albums directory tree. Some legitimate plugins do include an .htaccess file; verify these by inspecting with Notepad (or any other equivalent plain-text editor). In general however, an .htaccess file usually resides within the /www or /public_html directories and is usually legitimate. Note however, this file can be hijacked as well, so a visual scan and inspection of this file is a must, if such file exists. If an .htaccess file is indeed found within the /albums directory tree, delete it/them. And all others found under this directory.
If, after inspection, files and/or folders are found that shouldn't be there, delete them. If, after inspection, files and/or folders are found that shouldn't be there and can't be deleted or modified, the webmaster's options are limited.
The first step is to verify file ownership and permissions. The file in question should be "owned" by the domain name (or name that your host has given you). Verify ownership from the web host's control panel (usually cPanel or similar) file manager. While FTP apps prove extremely useful for most website publishing needs, most FTP apps do not furnish the required authentication necessary to take ownership of a rogue file or folder. So it's best to utilize the online file manager that comes as part of your domain package. Attempt to delete the folder in question. If this fails, attempt to change the permissions of the file in question to 755 (0755). If this fails, you will need to contact your web host and seek assistance in deleting the file.
Once the rogue file/folder has been removed, website cleansing may resume. Upon completion, gallery restoration, including database manipulation, if necessary, may begin.