Search The ForumSearch   RegisterRegister  LoginLogin

AfterLogic Aurora Files

 AfterLogic Forum : AfterLogic Aurora Files
Subject Topic: Can’t login anymore Post ReplyPost New Topic
Author
Message << Prev Topic | Next Topic >>
Rovanov
Newbie
Newbie


Joined: 18 January 2022
Location: Netherlands
Online Status: Offline
Posts: 33
Posted: 30 April 2024 at 1:37am | IP Logged Quote Rovanov

Hi Forum,

Suddenly, over night - unable to login.

1: DAV filesharing says: HTTP-error: Forbidden.
2: User- login says: "Cookies need to be updated. To continue click here or reload this page" I can log in, but the contentfield and left-sidebar remains blank.)
3: addminpanel says: Wrong login and/or password. Login failed. (InvalidToken)

Does anyone have a solution for me?
Thanks and best regards,
Rovanov
Back to Top View Rovanov's Profile Search for other posts by Rovanov
 
Rovanov
Newbie
Newbie


Joined: 18 January 2022
Location: Netherlands
Online Status: Offline
Posts: 33
Posted: 30 April 2024 at 3:04am | IP Logged Quote Rovanov


Do I have a VIRUS?

I found curious folders in the root of the aurora installation:
wp-admin
wp-content
wp-includes
and a "x" folder

Moreover, there is a file index.php0 and an index.php.

The index.php file starts with:
<?php @'$
x3=
x7=https://jan03.hmfsunsl3qfy/saiga.py
sps=00
urlgz=^[0:5]/!.html

Moreover, there is a file index.php0 and an index.php.

The index.php file starts with:
<?php @'$
x3=
x7=https://jan03.hmfsunsl3qfy/saiga.py
sps=00
urlgz=^[0:5]/!.html
';
and then a bunch of letters and characters
Back to Top View Rovanov's Profile Search for other posts by Rovanov
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6094
Posted: 30 April 2024 at 3:07am | IP Logged Quote Igor

Not entirely sure what could cause that, did you try deploying a blank installation of Aurora Files next to your existing one?

And it could be that your server was accessed by a malicious third party. The "wp-
wp-content" and "wp-includes" folder names are specific for Wordpress, and the file you're referring to has absolutely nothing to do with Aurora Files.

--
Regards,
Igor, Afterlogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
Rovanov
Newbie
Newbie


Joined: 18 January 2022
Location: Netherlands
Online Status: Offline
Posts: 33
Posted: 30 April 2024 at 3:13am | IP Logged Quote Rovanov

Thank you Igor!
What about the index.php file?
That one does look a little different from the original one.
Can I post my .htaccess file here?
Back to Top View Rovanov's Profile Search for other posts by Rovanov
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6094
Posted: 30 April 2024 at 3:19am | IP Logged Quote Igor

The content of index.php you posted isn't from Aurora Files.

Not sure why posting .htaccess content, but there's always a chance someone from the community here would assist. We only really help with the product itself when time permits (Aurora Files does not come with guaranteed free support from Afterlogic).

--
Regards,
Igor, Afterlogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
Rovanov
Newbie
Newbie


Joined: 18 January 2022
Location: Netherlands
Online Status: Offline
Posts: 33
Posted: 30 April 2024 at 4:39am | IP Logged Quote Rovanov

Thank you Igor!

I have restored a backup from two days ago. Now everything works again via the web interface. Also the files look normal.

Only the DAV connection to my file manager (Ubuntu) still gives the HTTP error:Forbidden

Do you have a solution for this?

Thanks!
Back to Top View Rovanov's Profile Search for other posts by Rovanov
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6094
Posted: 30 April 2024 at 4:42am | IP Logged Quote Igor

Does it work if you access DAV via web browser, with the browser plugin enabled? See Troubleshooting section at:

Configuring DAV server

--
Regards,
Igor, Afterlogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
Rovanov
Newbie
Newbie


Joined: 18 January 2022
Location: Netherlands
Online Status: Offline
Posts: 33
Posted: 30 April 2024 at 5:22am | IP Logged Quote Rovanov

Sorry Igor,
I don't know exactly what you mean.
I haven't changed anything on the server.
But I just discovered that there are multiple web applications with the same strange files and folders.
I'm afraid I need to restore the entire server.

Regards,
Rovanov
Back to Top View Rovanov's Profile Search for other posts by Rovanov
 
Rovanov
Newbie
Newbie


Joined: 18 January 2022
Location: Netherlands
Online Status: Offline
Posts: 33
Posted: 03 May 2024 at 12:37pm | IP Logged Quote Rovanov

Hi Igor,
Sorry for all. My server was hacked!

As far as it looks, they did not come in through the Aurora Files installation (it is installed on a subdomain) but through the main domain with a WP installation.

Thanks and sorry for your time

Warm regards,
Rovanov
Back to Top View Rovanov's Profile Search for other posts by Rovanov
 

If you wish to post a reply to this topic you must first login
If you are not already registered you must first register

  Post ReplyPost New Topic
Printable version Printable version

Forum Jump

Powered by Web Wiz Forums version 7.9
Copyright ©2001-2004 Web Wiz Guide