Question

My websites have been assaulted by a script kiddy very successfully. On a automated basis, a hidden script is accessed on my server that causes a modification of all my index.php files, and adds an iframe to the top of them (base 64 encoded).

I’m having trouble getting my hosting provider to help, as they say they are rather helpless in this matter.

I suspect that If I can determine which scripts are making use of php’s fopen function then I will be able to discover the location of the master tamper script and remove it.

Any advice?

Answer 1

Use find to find all of the PHP scripts and then grep for fopen. If you don’t have shell access, download the whole directory with the scripts and do it on your machine.

find /base/dir/with/your/scripts -name '*.php' | xargs grep 'fopen'