Your server was infected with a PHP backdoor trojan that goes by these names:
F-Secure: Trojan.Php.Backdoor.APF [Aquarius]
GData: Trojan.Php.Backdoor.APF [Engine:A]
NOD32: PHP/WebShell.NAH trojan
It is currently detected by roughly 38% of AV scanners that VirSCAN.org tracks. The way to test your AV for this exploit is simply by opening this pastebin and trying to download it as a file. Your AV should detect it, notify you of malware under one of those names from above, and deny download. If it's not detected, simply delete the downloaded file. Your system won't be infected, unless you run it through a PHP interpreter on your web server.
I've been reading the exploit's code, and frankly, it's pretty scary stuff and one of the most complete shells I've ever seen. Here are a few things it can do:
Overwrite any file the web application process it runs in will have access to.
Compress to ZIP and TAR archives (can inject itself into existing archives)
Brute-force FTP, MySQL, PostgreSQL access using web server's own CPU
Scripted interface for easy remote C&C shell control
POST requests for everything to hide from simpler WAF and avoid detection by web server rules
Complete Database Control including SQL shorthands for most common injections
Automated password and shadow file extraction for offline password extraction/cracking
File System Access Control including rewriting access permissions on files, directories
Enable / Disable reporting services to avoid detection through log files
Self-Destruction Mechanism to perform cleanup after other backdoors are installed
Password and cookie token protected to prevent easy sandboxed inspection of its functions (albeit the protection scheme is pretty weak, see my comment to the question)
Presume all your data, file system, operating system, everything infected and other backdoors installed to them. Presume all your passwords stolen, password and shadow files packed and downloaded. This is not a joke!
Sometimes, all you can do is...
It's the only way to be sure.
So what can you do? Like the image suggests, nuke it from orbit. Start from a clean slate and restore from a known good offline backup, before this exploit happened:
- Format the drive and reinstall OS, any other software you'll need, keep them updated
- Assume all your installation files infected / out of date and download latest versions
- Rethink what software packages you really need, and how you could harden remote access
- If you don't have it yet, install a SSL certificate on your web server, use encrypted access protocols on everything
- Reassess firewall rules, deny traffic on all ports you won't be using, inbound and outbound
- Install a good antivirus software and update its virus definitions regularly both on your server and on all clients that you'll be accessing your server from, enable heuristic scanning, regularly perform full system scan
- Never access your web server remotely from an untrusted location and/or unsecured connection like public access points for administration purposes
- Secure access to your CMS/panel software folders, files, URLs, password protect everything
- Assume all your passwords stolen, including passwords of any users of your online services
- Restore from an offline backup from before the date of the infection
- Inspect all restored from backup files and database records for injections, trojans, backdoors,...
- Write support code in your online services to demand password change for all your users and deny access before they do
- Notify all your users their passwords might have been compromised and they ought to change their passwords for any other third-party services they might use them for too
- Run each domain on your server from a separate VM and assign as limiting privileges to their processes as you can live with, lock files and database access permissions
- Hire an IT security consultant to assess vulnerability of your server and services it's running, act according to consultant's recommendation
- Assume I've forgotten to include something in this list, and find more information and recommendations to a similar scenario on this and other websites that you trust
Best of luck!