Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

7
  • 18
    "your entire web server is compromised by remote code execution:" - this was known already without eval. Commented Feb 17, 2016 at 19:52
  • 9
    Indeed I'd back up critical files, keep a download of the hack and generate a few sigs for clamav and run a scan on all the files you absolutely had to keep. Even then you can't be sure. I manually checked a server I recovered recently and had to generate several sigs for previously undetected php exploits. After generating the sigs, I turned up nearly 1000 infected files. You can never be sure. Commented Feb 17, 2016 at 19:54
  • Let us continue this discussion in chat. Commented Feb 17, 2016 at 20:39
  • 2
    I cleaned up the code and deobfuscated the numbers too: pasted.co/70105924. This should make it pretty clear what it's doing. Commented Feb 20, 2016 at 18:28
  • 4
    +1. If I could, I would give you +10 only for that bald guy image.... Commented Feb 21, 2016 at 16:18