Jump to content

Recommended Posts

  • FPCH Staff
Posted

I have a web site at GoDaddy. A couple of weeks ago, they sent me the following notice.

We recently completed a routine security checkup of our servers and platforms. Our scans flagged your hosting […] account as containing possible malware.
There were 7 files listed, all with a php extension. These files have the same names as other files on my site, but only with the php extension. For instance, I have a file called bfile0506.pdf. In the same directory, there is now a new file, that I didn’t create called fbile0506.php.

 

Then yesterday, GoDaddy called me about this possible malware. They were trying to sell me protection.

 

Anyway, I scanned 4 of the 11 files that GoDaddy suspected with Virus Total. They were all clean. I didn't waste any more time scanning the rest.

 

I then replied to GoDaddy’s email asking what program they used to determine if these files were malicious and what malware they suspect they contain.

 

It’s been almost 24 hours since I sent that email. They haven’t responded.

 

Any idea how did these php files got there?

  • FPCH Admin
Posted

Open the php files with notepad and search the file for any lines that begin with base64_decode.

 

An example would be something like this:

eval(base64_decode(long_string_of_random_characters) 

If you find any you can decode the string here to see what it is doing.

 

Base64 Decode and Encode - Online

 

If you find anything like that then the file is calling to an external server to download malware, most of the time a shell script. More then likely someone else on the server is running software that is being exploited and the server is already compromised. That would explain why files randomy showed up on your site.

  • Like 2
  • FPCH Staff
Posted

Thanks, I'm going to check a file or two out with that base64_decode.

 

Wouldn't VirusTotal have found something malicious, if there were anything, in these php files?

  • FPCH Admin
Posted

Yes attach a zip with the file in it

 

If you scan them the virus scanner will not pick them up as infected because the files themselves are not a virus. Nothing in them triggers the scanner. Once they download and deliver the payload then the virus scanners will pick it up.

  • Like 1
Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...