I have a client that I developed a new site for, it's not live yet because he wanted me to backup the old site first. This was a completely custom "directory" type site and the company that built it (in 2003) I think, build every single module for it from scratch.
Naturally I start looking at the vast amount of folders located on the server, and what is inside of those folders. I noticed that there were some random character PHP files, and also random character files with the last part of the file name "php.jpg" and that struck me as odd.
Examining the PHP files it was very easy to figure out what kind of attach it was as the creator of the tool left his signature at the top and bottom of the files.
The image format files are what struck me as interesting, I assume they were put there as a fail-safe so if someone where to notice the infected PHP files, this attacker had a way to restore access by renaming the "image" format files.
So here's where I either got stupid, or just wanted to ensure that these image files might be legit and need to be backed up for the client. Big mistake. I opened one file, and Windows 10 Security Center instantly flagged it as an infection.
Here is the event log provided me regarding the threat.
Because it was a shared hosting account, with no Shell access, I wasn't able to install any linux based security tools, (clamav, rkhunter, etc).
What would you have done in this situation? Just back up the entire site, and leave the infections in the backup files, or go through and clean up the hacks?