Loaded Commerce Community

I found these hacked PHP files in my /public_html directory

bots.php
byroe.php
hax0r.php
mail.php
main.php
osh.php
read.php
sempak.php
view.php

in the /public_html/images directory

SSpread.php
ShadowXphp
ShadowID.php
Shadow.php
Ps-X.php
break.php
bots.php
bad.php
about.inc.php
about.php
aa.php

Don't know how they got there. The files all have very recent dates, comparing to my backup files, they don't belong, so I deleted them.

Can someone tell me how to patch this security hole? (I already patch admin/includes/application_top.php last year)

I wrote a few ideas down here to improve basic security of your store:
http://www.codemehappy.com/2010/11/top- ... -security/

If you want the convenience of being able to upload image files to /images through the admin then there's a reason anyone else can too. The main thing is disabling any script from executing once it's there using htaccess.
None of the list will stop a determined hacker, but as most attempts are just automated bots anyway, they should provide some help.

Simon

For now, I added a password for the /admin folder. Will that work just as well?

No.

This type of file distribution indicates that the cracker had access to either FTP, a control panel file manager, a working back door with access to the full web space (everything below public_html) or the store admin file manager.

Change ftp and control panel file access credentials, change the admin login, do a full file set cleanup, remove the admin file manager and define languages tools, apply the php_self patch and install SSL. That should get you started.

David