Reuploading my original vars.php file seems to have solved the “Magic” problem. Comparing the dates and file sizes of other files with those on my local machine, I discovered that my .htaccess file had a different date 7/30/09. I know I didn’t change it and no one else works on my site, so I replaced it with my original, too. So far, so good.
In hindsight, I probably should have downloaded it to look at and see what had been added/changed: it’s only a text file after all.
Anybody else have their .htaccess file changed by this Trojan?
I’m still not clear how it got in. I don’t allow comments unless they’ve been approved: too much spam.
