Comments on: PHP Exploit URL foxes Apache http://www.scamdex.com/ScamBlog/2009/05/php-exploit-url-foxes-apache/ Scamdex's Somewhat Cynical Take on Scams Sat, 28 Jan 2012 10:12:00 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: mxw http://www.scamdex.com/ScamBlog/2009/05/php-exploit-url-foxes-apache/comment-page-1/#comment-2691 mxw Thu, 20 Aug 2009 21:21:44 +0000 http://www.scamdex.com/ScamBlog/2009/05/php-exploit-url-foxes-apache/#comment-2691 l;kl; l;kl;

]]> By: mxw http://www.scamdex.com/ScamBlog/2009/05/php-exploit-url-foxes-apache/comment-page-1/#comment-2670 mxw Fri, 14 Aug 2009 01:51:41 +0000 http://www.scamdex.com/ScamBlog/2009/05/php-exploit-url-foxes-apache/#comment-2670 Thanks for the note - This annoyed the life out of me for a while.... Thanks for the note – This annoyed the life out of me for a while….

]]> By: nv1962 http://www.scamdex.com/ScamBlog/2009/05/php-exploit-url-foxes-apache/comment-page-1/#comment-2669 nv1962 Thu, 13 Aug 2009 23:46:04 +0000 http://www.scamdex.com/ScamBlog/2009/05/php-exploit-url-foxes-apache/#comment-2669 For enlightenment about this specific variant of remote file inclusion (RFI) attacks, see: http://www.josepino.com/?howto_website_hack1 Since you use WordPress, consider Bad Behavior. Stops 'em good. For enlightenment about this specific variant of remote file inclusion (RFI) attacks, see:
http://www.josepino.com/?howto_website_hack1

Since you use WordPress, consider Bad Behavior. Stops ‘em good.

]]> By: Phil http://www.scamdex.com/ScamBlog/2009/05/php-exploit-url-foxes-apache/comment-page-1/#comment-2661 Phil Sat, 04 Jul 2009 03:14:55 +0000 http://www.scamdex.com/ScamBlog/2009/05/php-exploit-url-foxes-apache/#comment-2661 I'm not a guru but I did get something like this on my server. I first deleted the cron that looked something like this. /home/virtual/site1/fst/var/tmp/.fx/y2kupdate >/dev/null 2>&1 Then deleted all the files that start with php in the /tmp folder. I found a file that had been unzipped fx.tgz in the path above and deleted it and the files. I was first made aware of all of this in my cron. Check your crons. I’m not a guru but I did get something like this on my server.

I first deleted the cron that looked something like this.
/home/virtual/site1/fst/var/tmp/.fx/y2kupdate >/dev/null 2>&1

Then deleted all the files that start with php in the /tmp folder.

I found a file that had been unzipped fx.tgz in the path above
and deleted it and the files.

I was first made aware of all of this in my cron. Check your crons.

]]>