My apologies this may sound like a paranoid question...

Recently my friend's website was infected by malware.

With her permission, I FTP into her account to have a look and found some malicious PHP files with Base64 (i think?) strings as well as TXT files that seem like Bash/Perl scripts calling "wget" on some server.


  1. I won't get infected by viewing/editing those PHP and TXT files right? (I use FTP to download them and Aptana Studio 3 to view them).

  2. I tried decoding the supposedly Base64 string using an online decoder. The operation failed (i.e. nothing was decoded). Nothing was also downloaded. Doing this won't cause my PC to be infected right?

Thanks guys.

2 Answers 2


Not so paranoid, Opening files in a text editor should be safe. Opening other file types is more risky, PDF's, images, office documents, have all had vulnerabilities where opening the file in certain viewers. Most text editors are simple enough that they have few vulnerabilities.

Ensure you never run the .php files, I would recommend changing the file extensions to .txt as soon as you download them.

Extra step for the paranoid, I would also recommend opening the files in a simple text editor, like notepad, editpad pro, sublime text or similar. The more complex and the more the editor understands the format the more likely it is that there is a bug which could be exploitable. This is much more a problem with complex formats like .doc or .pdf.

Further Response

There is the academic answer and the pragmatic answer and they are different.

The academic answer is that it is possible that opening any file in any editor could compromise your box. It is possible that copying the encode text into your paste buffer compromised your box. It is possible that pasting the encoded text into a website compromised your web browser which compromised your box.

The academic answer is not very helpful.

The pragmatic answer is, you'll be fine as long as you did not execute the files. Though the academic answer is factually correct, it is highly improbable the attacker the compromised the server either had access to or was willing to use zero-day attacks against desktop software.

For next time you are doing incident response or malware examination you should consider doing the work in a virtual machine, and discard any changes to the virtual machine once you are done with a piece of work.

  • Thanks @David Waters. So the answer to Q1 and Q2 is "No, there is no risk of infection"? Dec 22, 2014 at 6:34
  • 2
    Honey - no, it's never a 'no risk' - it's just unlikely.
    – Rory Alsop
    Dec 22, 2014 at 9:01
  • @HoneyBadger : I have expanded my answer Dec 22, 2014 at 22:49

As the data is embeded in a PHP script file, it is perfectly safe to download the file and edit in a script editor.

If you do manage to decode the obscured data, you do, of course, need to be careful how you handle that.

There is no danger to you or anyone else as long as you are not trying to interpret the data automatically. Even trying to interpret the obscured data by unencoding it will not present a particular danger though the resulting file might itself be dangerous depending on the file type resulting. PDF files can be dangerous if loaded into Adobe reader (use Ghost script or another simple reader if not sure, preferably in a throw-away VM), Image files can be dangerous due to possible bugs in the OS handling of images. Script files (PHP, PERL, etc.) are never dangerous unless executed.

  • Thanks Julian. I pasted the obscured data in an online decoder (I use Chrome browser), but the decoding failed. And no file was created or downloaded by Chrome. So I guess there's nothing to worry, right? Dec 22, 2014 at 13:41
  • 1
    Well someone did it for a reason so it will be a payload of some kind. Probably best just to tidy it up along with changing passwords, checking running progs, and other tightening of security on the server. To make sure they don't come back. Dec 22, 2014 at 23:26
  • 1
    Oh, and put the PHP code under source control so that you can wind back to previous versions or keep the master code offline and push it from time to time. That way you can be totally sure of having clean code. Dec 22, 2014 at 23:27
  • Just to clarify: As long as when you're decoding a Base64 string using an online decoder, and if no file was downloaded as a result of that decoding, then it is fine correct? Dec 23, 2014 at 0:07
  • 1
    Yes, that is correct. Dec 23, 2014 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .