Daz -
Yes, that's malicious.
Here's what to do.
1. Download the latest zipfile from here: http://www.formtools.org/download.php
2. Unzip it locally, and delete the /install folder. Then, upload the entire contents to your website, overwriting the old files.
3. In your download package, did you upgrade any modules as well? You should manually update those as well.
The problem is now fixed on the site, but I'm taking the Upgrade and Custom Build scripts offline until the new website is rolled out.
I'm *exceedingly* sorry - and very distressed there's still a backdoor somewhere on the site that's allowing the hacker in. The problem is, it's very difficult to know where the flaw resides. As mentioned, there are thousands of files on the site, any one of which may be compromised.
I noticed that myBB (the maker of these forums) encountered the exact same problem back in October of last year (http://blog.mybb.com/2011/10/25/some-clo...erability/). I've contacted them; perhaps they may shed some light as to the cause.
- Ben
[EDIT: also, you'll need to clear your browser cache after updating all the files].
Yes, that's malicious.
Here's what to do.
1. Download the latest zipfile from here: http://www.formtools.org/download.php
2. Unzip it locally, and delete the /install folder. Then, upload the entire contents to your website, overwriting the old files.
3. In your download package, did you upgrade any modules as well? You should manually update those as well.
The problem is now fixed on the site, but I'm taking the Upgrade and Custom Build scripts offline until the new website is rolled out.
I'm *exceedingly* sorry - and very distressed there's still a backdoor somewhere on the site that's allowing the hacker in. The problem is, it's very difficult to know where the flaw resides. As mentioned, there are thousands of files on the site, any one of which may be compromised.
I noticed that myBB (the maker of these forums) encountered the exact same problem back in October of last year (http://blog.mybb.com/2011/10/25/some-clo...erability/). I've contacted them; perhaps they may shed some light as to the cause.
- Ben
[EDIT: also, you'll need to clear your browser cache after updating all the files].