[pmwiki-users] n=Profiles.smap

christopherpriest christopherpriest at yahoo.com
Thu Dec 22 11:15:59 CST 2011


I appear to have been hacked due to the presence of .htaccess and
iMdex.php files that don't belong to me plus a new .php file

Anyway, I'm going to upgrade my pmwiki and want to know if the
n=Profiles.spam as shown below in the server log mean I have to do some
editing on the pmwiki database.

By that I mean does the Profiles entries mean they have added
user/passwords to the file.

I'm afraid that just upgrading will still leave me vulnerable.

Thanks, Chris

188.255.16.126 - - [22/Dec/2011:11:50:44 -0500]
"POST /homeserve/pmwiki/pmwiki.php?n=Profiles.CytotechnologyJobs?action=edit HTTP/1.1" 200 1305 homeserve.org "http://homeserve.org/homeserve/pmwiki/pmwiki.php?n=Profiles.CytotechnologyJobs?action=edit" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"
188.255.16.126 - - [22/Dec/2011:11:50:45 -0500]
"GET /homeserve/pmwiki/pmwiki.php?n=Profiles.BuyRetinA?action=edit
HTTP/1.1" 200 13209 homeserve.org "-" "Mozilla/4.0 (compatible; MSIE
6.0; Windows NT 5.1; SV1)" "-"
188.255.16.126 - - [22/Dec/2011:11:50:50 -0500]
"POST /homeserve/pmwiki/pmwiki.php?n=Profiles.Vogue?action=edit
HTTP/1.1" 200 1266 homeserve.org
"http://homeserve.org/homeserve/pmwiki/pmwiki.php?n=Profiles.Vogue?action=edit" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"
188.255.16.126 - - [22/Dec/2011:11:50:54 -0500]
"POST /homeserve/pmwiki/pmwiki.php?n=Profiles.BuyRetinA?action=edit
HTTP/1.1" 200 564 homeserve.org
"http://homeserve.org/homeserve/pmwiki/pmwiki.php?n=Profiles.BuyRetinA?action=edit" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"
95.25.99.96 - - [22/Dec/2011:11:51:13 -0500]
"GET /homeserve/pmwiki/pmwiki.php?n=Profiles.Elimite?action=edit
HTTP/1.1" 200 13026 homeserve.org "-" "Mozilla/4.0 (compatible; MSIE
6.0; Windows NT 5.1; SV1)" "-"
31.184.238.181 - - [22/Dec/2011:11:51:17 -0500]
"POST /homeserve/pmwiki/pmwiki.php?n=Profiles.Clomiphene?action=edit
HTTP/1.1" 302 204 homeserve.org
"http://homeserve.org/homeserve/pmwiki/pmwiki.php?n=Profiles.Clomiphene?action=edit" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"
31.184.238.181 - - [22/Dec/2011:11:51:18 -0500]
"GET /homeserve/pmwiki/pmwiki.php?n=Profiles.Clomiphene HTTP/1.1" 200
9198 homeserve.org
"http://homeserve.org/homeserve/pmwiki/pmwiki.php?n=Profiles.Clomiphene?action=edit" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"
95.25.99.96 - - [22/Dec/2011:11:51:18 -0500]
"POST /homeserve/pmwiki/pmwiki.php?n=Profiles.Elimite?action=edit
HTTP/1.1" 200 560 homeserve.org
"http://homeserve.org/homeserve/pmwiki/pmwiki.php?n=Profiles.Elimite?action=edit" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"
95.25.99.96 - - [22/Dec/2011:11:51:20 -0500]
"GET /homeserve/pmwiki/pmwiki.php?n=Profiles.CialisSoftTabs60Pills?action=edit HTTP/1.1" 200 13131 homeserve.org "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"
95.25.99.96 - - [22/Dec/2011:11:51:25 -0500]
"POST /homeserve/pmwiki/pmwiki.php?n=Profiles.CialisSoftTabs60Pills?action=edit HTTP/1.1" 200 1307 homeserve.org "http://homeserve.org/homeserve/pmwiki/pmwiki.php?n=Profiles.CialisSoftTabs60Pills?action=edit" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"
188.255.16.126 - - [22/Dec/2011:11:51:26 -0500]
"GET /homeserve/pmwiki/pmwiki.php?n=Profiles.DiflucanYeastInfection?action=edit HTTP/1.1" 200 13307 homeserve.org "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"
188.255.16.126 - - [22/Dec/2011:11:51:27 -0500]
"GET /homeserve/pmwiki/pmwiki.php?n=Profiles.LevitraBuyLevitraOnlineViagra?action=edit HTTP/1.1" 200 13627 homeserve.org "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"




More information about the pmwiki-users mailing list