Support » Developing with WordPress » Weird and Dangerous : ro8kfbsmag.txt

  • Well, I don’t know where to post this question.

    LAST WEEK, I had a big problem on my wordpress installation. All the plugins was disable and all the “attachement” posts status had changed to “post”… As a result, I saw no uploads file via the admin browser.

    After a short investigation, I saw that the last post in the database had only “ro8kfbsmagtxt” for content…

    I was able to repair the site by using a backup on my server.

    YESTERDAY, I was browsing via SSH on my server and I found in the TMP folder a file called “ro8kfbsmag.txt”… Hum hum. I downloaded it, and it’s a PHP script, with a form, and with the title :”Magic Include Shell by Mag icq 884888”

    Well, I don’t like it… 😮

    Here is the content of the file… If any WP guru could take care of it, It sounds dangerous to me…

    S.

    ———- ro8kfbsmag.txt —————

    <?php
    /*Magic Include Shell by Mag icq 884888*/
    //TODO: ñëèòü ôàéëî íà ñâîé ôòï (!), ðàáîòà ñ äèðàìè (.), ðåíåéì ôàéëîâ (?), îòïðàâêà ïîñò, ãåò, êóêîâ ÷åðåç ñîêåòû (!!!)
    $ver='1.6';
    if(isset($_GET[pizdecnax]))
    {
    ...

    Large PHP code removed by moderator. You can find this file via google, if you want.

Viewing 46 replies (of 46 total)
Viewing 46 replies (of 46 total)
  • The topic ‘Weird and Dangerous : ro8kfbsmag.txt’ is closed to new replies.