All geek questions in one place

Unknown code on web pages

I find unknown code on our web pages. We also noticed that several websites hosted on our publicly accessible web hosting service are mysteriously deleted.

The unknown code that we found is displayed below in image format. Please tell us what code it is and how we can avoid adding this code to our web pages.enter image description here

+3
source share
3 answers

Yes, it looks like a backdoor identical to this . I think this is an interesting post, it looks through the process of decoding it and a bit on how to clean your system.

0
source

, /​​/, , . . № 3 .

RAT, base64_decode, eval(base64_decode( "whole_bunch_of_obfuscated_stuff")); , !

:

  • ; , / .
  • , , dev@thegothicparty.com RAT.
  • Search for another RAT on your system: do [~] grep -r "base64_decode" .as high as possible the directory tree. See the article mentioned below for more information.
  • Contact your ISP. Under certain conditions, such a remote control tool may cross user accounts.

An article on RAT and Server RAT Infection is available at gothicparty.com.

You can read it here: http://thegothicparty.com/dev/article/server-side-virus-rat/

0
source

Source: https://habr.com/ru/post/1796036/

More articles:


All Articles