[arob42]

Originally Posted by MarcoH64

Chances are big that this was not done using GAS, but that this file by coincidence ended up in the GAS directory.

This kind of hack is mostly done by someone gaining access to your server using Telnet/SSH (or maybe FTP) and placing his files in many directories, probably also using many different names, or even modifying existing files.

You should consider your server as infected and insecure at this time, and your passwords to be compromised. I suggest you contact your host about cleaning the server and resetting all passwords.

I am still looking into exactly how this happened. It was an old polling script that was compromised, but it was accessing the tt.txt file in the gas directory to do its dirty deed. It changed the permission on tt.txt to executable and then executed it using a tool25.dat hacking tool by the hacker known as r3v3ng4ns. Grrrrr