Weird and Dangerous : ro8kfbsmag.txt
-
Well, I don’t know where to post this question.
LAST WEEK, I had a big problem on my wordpress installation. All the plugins was disable and all the “attachement” posts status had changed to “post”… As a result, I saw no uploads file via the admin browser.
After a short investigation, I saw that the last post in the database had only “ro8kfbsmagtxt” for content…
I was able to repair the site by using a backup on my server.
YESTERDAY, I was browsing via SSH on my server and I found in the TMP folder a file called “ro8kfbsmag.txt”… Hum hum. I downloaded it, and it’s a PHP script, with a form, and with the title :”Magic Include Shell by Mag icq 884888”
Well, I don’t like it… 😮
Here is the content of the file… If any WP guru could take care of it, It sounds dangerous to me…
S.
———- ro8kfbsmag.txt —————
<?php /*Magic Include Shell by Mag icq 884888*/ //TODO: ñëèòü ôàéëî íà ñâîé ôòï (!), ðàáîòà ñ äèðàìè (.), ðåíåéì ôàéëîâ (?), îòïðàâêà ïîñò, ãåò, êóêîâ ÷åðåç ñîêåòû (!!!) $ver='1.6'; if(isset($_GET[pizdecnax])) { ...
Large PHP code removed by moderator. You can find this file via google, if you want.
- The topic ‘Weird and Dangerous : ro8kfbsmag.txt’ is closed to new replies.