Just got the memo from Eeems on Google+.

Honestly, it's strange. The only thing they did is replace my index.php files and I'm not the only person they did that to.
There are hundreds of completely random sites that have been given the same treatment and I can't really figure out how they managed it. There's literally no correlation between the site that were defaced and no explanation. I thought they may have gotten my FTP or 1and1 password somehow, but it ONLY affected my websites that use the removedfromgame.com domain. The others were untouched.

I'm thinking the ONLY possibility is that my upload form isn't completely secure but without knowing exactly what they did, I can't really make it invulnerable. At least, not very soon.
Anyway, I'll see if I can get the image uploader back up quick before I go to bed and deal with this... later. I'm moving this weekend so this really couldn't have happened at a worse time.

Update: It's back up. Glad I had an extra copy of the homepage lying around and they didn't do any real damage. The other pages that use the removedfromgame.com domain are still down and some of them may remain that way permanently. I'll keep you updated when I actually have time to deal with it. =/

Defaced for me too

Not for me. I guess it's your cache.

The images are still up.

@{AP}, as far as I can tell, the group uses automated tools to do whatever they do. There's no real  connection between any of the defaced sites, except that the sites are immediately reported as defaced by them. Might just be a "prize" kind of thing?

DJ, I've tried refreshing the test image bunch of times. I'm pretty sure it's not in my cache.

The main page and the images all works, that's what I meant, as not being defaced.

removedfromgame is defaced for me, but not img.removedfromgame.

Yeah, like I said. Those sites are all still down. I only fixed the image upload homepage because that's what most of you use and I didn't have time to deal with anything else.

The Userbar site will take a while to to get back up because I lost actual code there.
The main site ( http://removedfromgame.com/ ) didn't have anything there in the first place so I'm not going to mess with that for a while longer.
_________________________________________________________

I have made the move to my new house but I'm going to be concentrating on job hunting more than anything and then I'll have to adjust to whatever new schedule that job has for me.
After ALL that is taken care of, I can get back to handling this little defacing issue.
_________________________________________________________

Also, let me clarify the situation. No files were lost (except the homepages to the affected sites) and no information was taken. It wasn't a real hack, just a script that managed to upload new "index.php" files to my server and the pages are 100% clean. So everyone, and everything they put up through my sites, is completely safe.

Sorry for any inconvenience caused by the horrible timing of this random script kiddie attack.