Searches for exhibit engine - possible hack?

[MikeCaine]

I've noticed a few searches for exhibit engine in my logs.

Last time searches for a particular script appeared in the logs that script was hacked and my site was compromised.

I'm wondering if there's any sign of hacks using exhibit engine, or is someone just searching for sites that use this software to view the galleries?

[pukkita]

You're on the track, check http://photography-on-the.net/forum/showthread.php?t=177618 and http://photography-on-the.net/forum/showthread.php?t=177456

[MikeCaine]

Yeah, I posted my message before those threads appeared. I had a feeling something bad was going on :-(

Now I've got a right mess to try to sort out

[pukkita]

did they hack your site? If it wasn't too customized, close the holes (register globals, etc) do a backup (connect.php, preferences.php, etc) wipe everything and start over (assuming your mysql db won't be wiped too).

[MikeCaine]

Looks like I had various IRC bots installed. I'm just trying a reinstall from from local copy backup of the files.

I struggled to do this recently after moving host and I hate to go through all of that again.

It's a pity version 2 isn't out yet