Hacked with Obfuscated Code - What did I do wrong?

[risrik]

Hi,

I was wondering why nobody was coming to my directory and then noticed that Google flagged it as "This site might harm your computer." When I did a check, each of the main level php pages had some obfuscated code (javascript encoded). It wasn't doing anything bad to my site so that's why I never noticed it. I removed it (it was before and after the HTML tag) and asked Google to review it so I get some traffic again!

Anyways, how could this have happened? I checked the permissions on those main level files and they were all 644 (conf was 444). How did someone get in and add that javascript to the end of each page?

Thanks!

[James]

Chances are it was a root server hack in which someone got in via something along the lines of an outdated joomla or mambo install .. uploaded a phpshell script then ran a script with root privileges that add the code to every file they indicated usually you just see this in index.* pages.