Possible Server Infection?

From: Date: Sat, 04 Apr 2009 23:12:06 +0000
Subject: Possible Server Infection?
References: 1 2 3 4 5 6  Groups: php.general 
Request: Send a blank email to php-general+get-291076@lists.php.net to get a copy of this message
Hi all, I was wondering if someone might know about a problem I'm having on my server. It appears that I've been infected by a rogue PHP script(?). Something has gone through my server and placed .htaccess files in every directory that didn't have one with contents that look like this: Options -MultiViews ErrorDocument 404 //graphics/cc/111152.php The path is different for each file and corresponds to the directory that it's in. The php document name is a different number for each file I've found. Does this sound familiar to anyone? What would be the purpose of placing files like these in the directories? As far as I know, there isn't a file called "111152.php" anywhere on my site, so this doesn't make any sense to me. I realize that this is a very general question, but I'm hoping that someone has seen or heard of this type of thing before and can help me eliminate the problem. I'm using A2 Hosting and they don't know why this happened. Thanks, Frank

« previous php.general (#291076) next »