and there is any way to block it?
some files were changed where the server is 0644, so the web interface will not be able to change those (right??? I'm not an expert here).
So, I will think that it's more like it was changed from inside.
Some other posts on the internet comment about it being create via AVATAR folders (because the hacker can upload files there).
