How to edit files without changing the last modified date? One of my sites recently got hacked with the dreaded pharma-hack. The hacker inserted base64_decode'd code into includes/bootstrap.inc

Initially I thought the FTP password was discovered since the password was quite weak.

However, the Hosting providers indicate that there has been no FTP access from other than my I.P. address. And also the file bootstrap.inc's "Last Modified" date has not been changed.

I let the client know to change his FTP password, and he's only done it a day after. However during that time, they changed another file includes/cache.inc (must've realised the code has been removed from bootstrap.inc), but the cache.inc's Last Modified date didn't change either. So now he's (client) changed his FTP password, but I'm worried that this hacker is gaining access not by through FTP, but by some other means. 

I've thoroughly went through the site, and haven't noticed any abnormal, or out of place *.php files uploaded into the directories. Maybe I haven't looked hard enough? What other means are there to change a file's contents without using FTP? And how to change a file without changing the modified date?

Drupal 6.

Thanks.



Update: Most likely an FTP breach, as the affected site had a very weak FTP password (8 char only, all lowercase, only alphabets). This was probably done through brute force guessing the password, and then uploading a file that's sort of like a file manager. I seen this file cleverly (well not so I guess) disguised as LICESNE.php (hacker can't spell :) ) and ironically I managed to hack this file and gain access to the administration screen.

From this page you can create new files, modify existing files and run scripts on the server, delete files, manage databases etc. It was a 1 page hacker administration page!

The sites have not had a breach now as I've done the security updates and changed the passwords to secure ones.

Again thanks for all the answers and comments. Much appreciated.
Consider this PHP code:

touch('/path/to/file', strtotime('-1 month'));


That will change a file's modified date to one month ago.

It's pretty easy to mess with the modified date of a file if you've got access to the server, which your hackers obviously have (at least to some degree).