Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Today I noticed that I was unable to get a website to load up consistently, so I decided to look at the log files generated on the server. To my amazement, almost all of the files requested were having their paths modified, and not by the php-code that the site consists of. The site is hosted with GoDaddy.

Requests to /stories/rss was instead being made to VOadK/stories/rss or VgpUU/stories/rss. The random characters at the beginning change with each request it seems. I've never seen anything like this in my 10 years of web-development, so I'm at complete loss of what to do.

Does this sound like a server/apache issue? I've tracked the first offense in my log back to yesterday morning around 5am:

2009-11-30 05:07:06 -07:00 --- error: Uncaught Kohana_404_Exception: The page you requested, VUPWT/forums, could not be found. in file system/core/Kohana.php on line 841
2009-11-30 05:08:38 -07:00 --- error: Uncaught Kohana_404_Exception: The page you requested, YLPQR/css/reset.css, could not be found. in file system/core/Kohana.php on line 841

Note the random paths. Just prior to these lines in the logs, I saw requests for a file named 4273uaqa.gif. I have no files even remotely similar to this, so I googled it. What came up was interesting - references to the same file, including the random URL segments!

This has me wondering if I was the victim of a shared-server-hack. I am also using .htaccess, which does attempt to rewrite urls, so this may be of relevance:

# Turn on URL rewriting
RewriteEngine On

# Installation directory
RewriteBase /

# Protect application and system files from being viewed
RewriteRule ^(application|modules|system) - [F,L]

# Allow any files or directories that exist to be displayed directly
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

# Rewrite all other URLs to index.php/URL
RewriteRule .* index.php?kohana_uri=$0 [PT,QSA,L]

Thoughts?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I'd say you've been hacked. Further googling of the prepended character strings produces suspicious results.

share|improve this answer

The cause of this is still unknown ("officially"), but getting a static ipaddress apparently fixed the issue.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.