How do they "copy" it? Whare are the files' creation dates? What's in the web logs? Inquiring minds, and all that. Google finds several which have been hacked long enough to have been indexed!
Dan -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of john cesta Sent: Tuesday, January 04, 2005 2:06 PM To: Bill Landry Subject: [IMail Forum] hacked by tugr@ Has anyone heard of this one? What they do is to copy: index.php .cfm .htm .html .asp default.php .cfm .htm .html .asp to the root folder of every web site. I can't find much on it on the web. I thought I had figured it to be an old servu ftp server hack so I upgraded about 3 weeks ago but today upon reboot it happened again. I have a fully patched win2k server Thanks To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
