KhmerAK* | All around Cambodia & Technology

There was a scary strange thing happening recently on one of my website which was unexpectically happening that way.

The site was down! OMG, it’s nightmare time again! I thought it maybe was my colleague updating some wrong scripts onto the site and upexpectically making the site stop working, but after a while checking all the possible causes that can put the site down, i have found that the code was exacully changed but not look like not by the person. The files with name “index” and “default” were added by a strange code, and some were duplicated the entire code and added at the bottom of the file with the following stuffs:

Strange huh? it looks like a google analytics code that i use in the index of my site’s homepage to track the site’s traffic, but actually it’s not, it’s a fake Google Analytics.

This is kinda site’s virus? entering by the google analytics code to change all the index files in every directories of the entire site. Indeed it works like a virus! So to solve this, i have edited and removed all those strange codes so the site is working back to normal. But so sorry cause i have to remove Google Analytics code too

Still wonder, how could this kind of stuff entering to change the file on my server? Maybe the file is world writable? But, it’s not because all files on the server is 644 (world is not writable).

Have you ever seen stuff like this?

This entry was posted on Friday, March 6th, 2009 at 12:31 pm and is filed under Code. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.