|
Posted by Mark on August 6, 2007, 5:09 am
If you were Registered and logged in, you could reply and use other advanced thread options
I found the following code snipped added to a page on a webserver:
<? if ((eregi("bot", $_SERVER['HTTP_USER_AGENT']) or eregi("urp",
$_SERVER['HTTP_USER_AGENT'])or eregi("msn", $_SERVER['HTTP_USER_AGENT'])))
?>
It looks as the purpose of this attack is to promote the website mentioned by
creating a link to it that is only visible to searchengine bots and crawlers.
I am very thankful for any help about what is causing this code to land on the
webserver. Both the web hoster and me checked the servers logfiles and checked
for rootkits, but could not find anything.
thanks, Mark
| 
XML site map