Hi,
I don’t have the script all I have found is they are replacing fclicks cfg.php with a meta refresh and must be getting in through some other vulnerability…on one forum I found nothing in the fclick but it still redirect to these bozos:
xhttp://kadooooooo.sitemynet.com/kadoo.htm
I was told “they are/were getting in via insecure permissions with wget, lynx and cURL and exploiting a security hole in Fclick” So I guess there is something, a worm on the server?
Ah what a fun day this is turning out to be…my tech guy is not available for another 5 hours. I have changed the permission on all my sites fclick trackers as they are all 666 and have set to 644