Just when I though the Drunkjeans Hack had passed over, there’s another attack on a couple of my sites. I’ll call it the “Comber 38” hack. These hacks are most likely related.
What does this hack do?
With Comber 38, your sites are turned into Viagra Promo sites. Search for “viagra hack” and you’ll see how common this problem is.
Even though your home page may still work, the hackers use your site as a storage for images that can be pulled in from other sites, hence poncing off your server’s bandwidth.
If these files are linked to, your site is redirecting to some viagra site. It gioves the hackers and spammers direct link to a clean site rather than having to use their spam domains directly. If it wouldn’t be so evil, you ould argue it’s a pretty bright idea…
In fact, here’s what’s in one of those files: