|
If you have access to raw logs check to see if it was just placed on the page and uploaded - this has been the most common way pages had this installed - most likely due to someone with access to a password file as there is never any intrusion attempts and the page is just ftp'd - most people that were hit were using a common password on their server and either a processing program or sponsor (we havent found the common one yet to figure out who's password list was compromised)
The second way is one of these programs with security holes:
Vbulletin
PHPBB
Autolinks
Invision Power Board
phpmyadmin
phpadsnew
wordpress
awstats 6.5
sitedepth
I-RATER
phpBazar
Most of these have recently released updates for their security holes
|