Anyone with a deep understanding of .htaccess files care to
look at a very suspect file which appeared in every
directory of a web site recently?

In particular reference to mod_rewrite

--
Rob_P
UKRM(at)indqualtec.co.uk
uppercase(d) BBIWYMC#1 BOG#11? MRO#31 IBCDBBB#1(kotl)
FJ1200, CCM130 Benelli Cabriolet (gone)
Looks like Rab C Nesbit.

On 22/05/2011 10:19, R C Nesbit wrote:
> Anyone with a deep understanding of .htaccess files care to
> look at a very suspect file which appeared in every
> directory of a web site recently?
>
> In particular reference to mod_rewrite
>

Lob it over if you wish.

chris at systemlabs dot co dot uk

--
Catman MIB#14 SKoGA#6 TEAR#4 BOTAFOF#38 Apostle#21 COSOC#3
Tyger, Tyger Burning Bright (Remove rust to reply)
116 Giulietta 3.0l Sprint 1.7 GTV TS GT 3.2 V6
Triumph Sprint ST 1050: It's blue, see.
#www.cuore-sportivo.co.uk

R C Nesbit escribió:

> Anyone with a deep understanding of .htaccess files care to
> look at a very suspect file which appeared in every
> directory of a web site recently?
>
> In particular reference to mod_rewrite
>


http://corz.org/serv/tricks/htaccess.php
--
Paul.
CBR1100XX SuperBlackbird (Buen mueble de patio), Orbea Dakar, Legs
BOTAFOT #4 BOTAFOF #30 MRO #24 OMF #15 UKRMMA #30
http://paulc.es/ (content pending)

Catman spoke:
> > Anyone with a deep understanding of .htaccess files care to
> > look at a very suspect file which appeared in every
> > directory of a web site recently?
> >
> > In particular reference to mod_rewrite
> >
>
> Lob it over if you wish.
>
> chris at systemlabs dot co dot uk

Cheers Chris, email on it's way.

--
Rob_P
UKRM(at)indqualtec.co.uk
uppercase(d) BBIWYMC#1 BOG#11? MRO#31 IBCDBBB#1(kotl)
FJ1200, CCM130 Benelli Cabriolet (gone)
Looks like Rab C Nesbit.

Paul Carmichael spoke:
> > Anyone with a deep understanding of .htaccess files care to
> > look at a very suspect file which appeared in every
> > directory of a web site recently?
> >
> > In particular reference to mod_rewrite
> >
>
> http://corz.org/serv/tricks/htaccess.php

Yes, I know, I've read lots, but I'm not a web expert and lines
like this:

RewriteCond %{HTTP_REFERER}
^(http\:\/\/)?([^\/\?]*\.)?(google\.|yahoo\.|bing\.|msn\.|yande
x\.|ask\.|excite\.|altavista\.|netscape\.|aol\.|ho tbot\.|goto\.
|infoseek\.|mamma\.|alltheweb\.|lycos\.|search\.|m etacrawler\.|
rambler\.|mail\.|dogpile\.|ya\.|\/search\?).*$ [NC]

and lots of lines like this:

RewriteCond %{HTTP_USER_AGENT}
!^.*(exactseek|Feed|Fetch|findlinks|FreeBSD|Friend ster|****\sYo
u|Google).*$ [NC]
RewriteCond %{HTTP_USER_AGENT}
!^.*(Gregarius|HatenaScreenshot|heritrix|HolyCowDu de|Honda\-Sea
rch|HP\-UX).*$ [NC]

have me stumped.

--
Rob_P
UKRM(at)indqualtec.co.uk
uppercase(d) BBIWYMC#1 BOG#11? MRO#31 IBCDBBB#1(kotl)
FJ1200, CCM130 Benelli Cabriolet (gone)
Looks like Rab C Nesbit.

On May 22, 10:19*am, R C Nesbit <s...@ukrm.net> wrote:
> Anyone with a deep understanding of .htaccess files care to
> look at a very suspect file which appeared in every
> directory of a web site recently?
>
> In particular reference to mod_rewrite

Might be worth trying the 'Fetch as Googlebot' facility in the
diagnostics section of Webmaster tools.

On 22/05/2011 16:53, R C Nesbit wrote:
> Paul Carmichael spoke:
>>> Anyone with a deep understanding of .htaccess files care to
>>> look at a very suspect file which appeared in every
>>> directory of a web site recently?
>>>
>>> In particular reference to mod_rewrite
>>>
>>
>> http://corz.org/serv/tricks/htaccess.php
>
> Yes, I know, I've read lots, but I'm not a web expert and lines
> like this:
>
> RewriteCond %{HTTP_REFERER}
> ^(http\:\/\/)?([^\/\?]*\.)?(google\.|yahoo\.|bing\.|msn\.|yande
> x\.|ask\.|excite\.|altavista\.|netscape\.|aol\.|ho tbot\.|goto\.
> |infoseek\.|mamma\.|alltheweb\.|lycos\.|search\.|m etacrawler\.|
> rambler\.|mail\.|dogpile\.|ya\.|\/search\?).*$ [NC]
>
> and lots of lines like this:
>
> RewriteCond %{HTTP_USER_AGENT}
> !^.*(exactseek|Feed|Fetch|findlinks|FreeBSD|Friend ster|****\sYo
> u|Google).*$ [NC]
> RewriteCond %{HTTP_USER_AGENT}
> !^.*(Gregarius|HatenaScreenshot|heritrix|HolyCowDu de|Honda\-Sea
> rch|HP\-UX).*$ [NC]
>
> have me stumped.
>

If you land from a search engine results page, you get re-directed to a
CGI bin folder on Herocopter's domain.

Oddly, I'm not going have a look to see what happens when you point a
browser at that pile of executables

--
Catman MIB#14 SKoGA#6 TEAR#4 BOTAFOF#38 Apostle#21 COSOC#3
Tyger, Tyger Burning Bright (Remove rust to reply)
116 Giulietta 3.0l Sprint 1.7 GTV TS GT 3.2 V6
Triumph Sprint ST 1050: It's blue, see.
#www.cuore-sportivo.co.uk