Can anyone tell me what this file is?
It infected my 3.8 forum, and I found it through both AV and the file name. I knew it didn't belong. What was strange was, the site worked fine, but the home page would not load. I restored from my backups several times and it would load fine for maybe 24 hours, then the same problem happened over and over, until I finally found and removed it. I lost months of posts, but finally seem to have the forum stable again. What I am wondering is if I have anything else to worry about? Has this file done anything else to my forum? I don't know PHP, and I am really in the dark about what this means. Although, it's obvious that there is some malicious code in it. Especially the part about "Webshell by oRb" and the lines from about 743 - 754.
Can anyone explain to me how this ended up in my web root and what the hell it did (or tried to do) to my forum? I have renamed the extension to txt and it should not be dangerous at all now. That is all I have changed about the file. Any help would be greatly appreciated. I have been running this forum for about 10 years and this is the most serious problem/attack I have ever had. If anyone can help me figure out what happened and/or how to avoid it from happening again, I sure would appreciate it.
|
11-26-2011, 10:57 PM
Hybrid Mode
