Hacker Toolları.Hacker Toolları,sisteme girildiğinde dosyalara atılan minik MODlar ve bu MODlar bütün dosyalara bulaşıyor ve sistemdeki mail adreslerini kullanarak her yere sizin tarafınızdan mail atıyor.....

Siteniz uzmanlarca derin incelemeye tabi tutulmuştur,
Bu incelemelerde , yurt dışından da destek alındı, ve eğer ingilizce biliyorsanız raporları aşağıdadır.
Dolayısı ile sitenizi tamamen silmemiz gerekmektedir.

I've found a shell script and an eggdrop ircbot under the username "boraboy" account. The files where hidden in the user's phpbb forum script, under the /images/avatars/index.txt folder. The abuser is trying to hide the bots under the /usr/local/directadmin/customapache/gd-2.0.33 folders also under the /usr/shm folders under various names. Ive left the files in the boraboy.net for you to look at in case you want to examine them or show them to the boraboy user.

Also found this under the boraboy.net user. /home/boraboy/domains/boraboy.net/public_html/phpBB2/includes/new.txt

It is part of an IRC bot, and it looks like it was setup to execute commands. if you look inside that file you will see the IRC channel, nickname and password they are using. It looks like the hackers were using an IRC bot on a channel to run commands on your server. The bots would run under a cron job and stay connected to the IRC channel even when the domains are being suspended. With any luck, these irc bots have log files we can look inside and maybe listen in on what the hackers were talking about or trying to do.