I’m very sorry to hear that you’ve been hit by this, as have been many others. I would like to recommend that you contact Matteo Beccati, he is almost certainly able to help you with the clean-up efforts.

Good luck, Erik Geurts

Do you know what entries were made in the DB that caused the stats to not show up?

Thanks!

Quickly translated email follows:

Hi,

I’ve been contacted by many customers around the world to solve the issues caused by an attack exploiting a vulnerability of the popular open source ad server OpenX (www.openx.org).

The mass infection took place on Saturday April 10 between 1pm and 2pm Italian time and it was coming from an IP address belonging to your network: 62.101.68.213.

Here are some excerpts from web server logs that I verified myself:

62.101.68.213 - - [10/Apr/2010:07:46:56 -0400] "GET /admin/index.php HTTP/1.1" 200 1388 "-" "Mozilla/5.0 (Windows)"
62.101.68.213 - - [10/Apr/2010:07:46:56 -0400] "POST /admin/install.php HTTP/1.1" 200 1529 "-" "Mozilla/5.0 (Windows)"
62.101.68.213 - - [10/Apr/2010:07:46:57 -0400] "POST /admin/index.php HTTP/1.1" 200 1438 "-" "Mozilla/5.0 (Windows)"
62.101.68.213 - - [10/Apr/2010:07:46:57 -0400] "GET /admin/account-switch.php?account_id=1 HTTP/1.1" 200 1378 "-" "Mozilla/5.0 (Windows)"
62.101.68.213 - - [10/Apr/2010:07:46:58 -0400] "POST /admin/plugin-index.php HTTP/1.1" 200 1367 "-" "Mozilla/5.0 (Windows)"



62.101.68.213 - - [10/Apr/2010:04:47:17 -0700] "GET /openx/www/admin/index.php HTTP/1.1" 200 4420 "-" "Mozilla/5.0 (Windows)"
62.101.68.213 - - [10/Apr/2010:04:47:21 -0700] "POST /openx/www/admin/install.php HTTP/1.1" 200 3688 "-" "Mozilla/5.0 (Windows)"
62.101.68.213 - - [10/Apr/2010:04:47:23 -0700] "POST /openx/www/admin/index.php HTTP/1.1" 200 4410 "-" "Mozilla/5.0 (Windows)"
62.101.68.213 - - [10/Apr/2010:04:47:26 -0700] "GET /openx/www/admin/account-switch.php?account_id=1 HTTP/1.1" 200 4263 "-" "Mozilla/5.0 (Windows)"
62.101.68.213 - - [10/Apr/2010:04:47:29 -0700] "POST /openx/www/admin/plugin-index.php HTTP/1.1" 200 4248 "-" "Mozilla/5.0 (Windows)"
62.101.68.213 - - [10/Apr/2010:04:47:32 -0700] "GET /openx/plugins/bannerTypeHtml/oxHtml/genericHtml.delivery.php HTTP/1.1" 200 175 "-" "Mozilla/5.0 (Windows)"


Thanks for staying on top of this. As you know I have been watching the forum posts and reports nervously about my installation. No problems yet.

CP

Thanks for your input and report. I’m afraid I don’t have a solution for this, but perhaps there is another reader that has an idea.

Regards, Erik Geurts

OpenX v2.8.4 running on Apache 2.2.3, PHP 5.1.6 and MySQL 5.0.77-.

The following error on clicking the “Inventory setup wizard”:

Fatal error: Call to undefined method Zend_View_Helper_Placeholder_Container::ksort() in /var/www/vhosts/visitarlondres.com/httpdocs/anuncios/www/admin/plugins/openXWorkflow/library/Zend/View/Helper/HeadLink.php on line 310

For 2.8.5 I cannot pass the second screen that asks for your openx.org details, seems like the lower part of the page is missing.

Any ideas?

Thanks for your response. I wrote this blog post well before the recent reports about potential security problems. It’s usually a good idea to stay up to date with the most recent versions of software. However, in the case of OpenX v2.8.5 I’m not entirely convinced yet.

Best regards, Erik Geurts

Thanks anyway.