Hi,

I just realised this afternoon the the 3 domains I have on the same host running zenphoto have been hacked. I have now deleted all zenphoto files except the albums and caches from all 3 installations but when I installed the latest update and tried to run zenphoto setup and type in mydomain/zp-core/upgrade.php I get redirected to a url in russia!

Help, what do I do?

Steve

Did you delete the .htaccess file?
Tried to clear your cookies and cache?
my guess is that you either didn't delete your .htaccess or still have a malicious cookie which redirects you.

I've this message: Parse error: syntax error, unexpected '=', expecting ')' in /my root/../functions.php on line 506

Hi,

Thanks for that, I did delete the .htaccess files in each of the zenphoto installs but I just discovered another one above my domains and in another domain that does not run zenphoto.

Yes I have cleared the cookies and cache.
I only found out about this less than a hour ago so I am still trying to get my head round what happened.

I will try to reinstall again.

Thanks for your help.

Steve

Have a look in this topic (http://www.zenphoto.org/support/topic.php?id=9951) at the post from jest3r, which explains in more details what the hack did, and what you might want to consider doing.

Hi,

One install now up and running, have also changed database pass as well. Now for the other 2 installs.

Thanks again for your help.

Steve

Hi,

I now have all my installs up and running. I know this might be obvious and mentioned in other threads but just to be on the safe side I have changed all my passwords on: the zenphoto mysql db, the zenphoto admin, my ftp account and server login.

Steve