New answers tagged backdoor
You may also have luck in booting into safemode with networking and running your antivirus and malware scans there. MOST viruses/malware I've run across don't function well in safemode. Good luck and hopefully I've caught you prior to scorched earth strategy.
You can try this http://www.ehow.com/how_5136136_remove-backdoor-rustock.html Also keep in mind that malware can be installed some times in Virtual FileSystem-VFS so tracking it down can be even more difficult.
The hacker used a publicly available shell MulCiShell v0.2. It can be configured to perform a number of functions including brute forcing passwords, downloading your entire site and replicating itself. You could take a closer look at mshell.php to see what it does. Edit: From your log files: He tried to access /etc/passwd which contain a list of system ...
Top 50 recent answers are included