Infected php files?

Tony D

Super-Moderator
Jan 18, 2016
SE Pennsylvania, USA
Windows XP
Windows XP
Chrome 49.0.2623.112
Chrome 49.0.2623.112
Thread starter Admin #1
I have a web site at GoDaddy. A couple of weeks ago, they sent me the following notice.
We recently completed a routine security checkup of our servers and platforms. Our scans flagged your hosting […] account as containing possible malware.
There were 7 files listed, all with a php extension. These files have the same names as other files on my site, but only with the php extension. For instance, I have a file called bfile0506.pdf. In the same directory, there is now a new file, that I didn’t create called fbile0506.php.

Then yesterday, GoDaddy called me about this possible malware. They were trying to sell me protection.

Anyway, I scanned 4 of the 11 files that GoDaddy suspected with Virus Total. They were all clean. I didn't waste any more time scanning the rest.

I then replied to GoDaddy’s email asking what program they used to determine if these files were malicious and what malware they suspect they contain.

It’s been almost 24 hours since I sent that email. They haven’t responded.

Any idea how did these php files got there?
 
Nov 19, 2003
Joliet, IL U.S.A.
OS X
OS X
Firefox 59.0
Firefox 59.0
Admin #2
Open the php files with notepad and search the file for any lines that begin with base64_decode.

An example would be something like this:
PHP:
eval(base64_decode(long_string_of_random_characters)
If you find any you can decode the string here to see what it is doing.

Base64 Decode and Encode - Online

If you find anything like that then the file is calling to an external server to download malware, most of the time a shell script. More then likely someone else on the server is running software that is being exploited and the server is already compromised. That would explain why files randomy showed up on your site.
 

Tony D

Super-Moderator
Jan 18, 2016
SE Pennsylvania, USA
Windows XP
Windows XP
Chrome 49.0.2623.112
Chrome 49.0.2623.112
Thread starter Admin #4
Thanks, I'm going to check a file or two out with that base64_decode.

Wouldn't VirusTotal have found something malicious, if there were anything, in these php files?
 
Nov 19, 2003
Joliet, IL U.S.A.
OS X
OS X
Firefox 59.0
Firefox 59.0
Admin #6
Yes attach a zip with the file in it

If you scan them the virus scanner will not pick them up as infected because the files themselves are not a virus. Nothing in them triggers the scanner. Once they download and deliver the payload then the virus scanners will pick it up.
 
Top Bottom