Infected php files.

[.one.]

Not sure if anyone can help i may be right off track here but..

I have some php files which i think one or more are infected.

Any free dedicated php detection software on the net ? or am i totaly miss in formed and a normal checker do the job.

Also i need it repaired do i hand edit or... ?

Sorry for the lack of understanding.

 

[Pho]

Can you post one of the infected files?

 

[andicole0]

PHP's have been attacked for a while now so I would expect any anti virus worth it's salt to able to detect and remove. You'll probably have to pay for a version to run on a server though.

Andi.

 

[fidget]

Not sure if anyone can help i may be right off track here but..

I have some php files which i think one or more are infected.

Any free dedicated php detection software on the net ? or am i totaly miss in formed and a normal checker do the job.

Also i need it repaired do i hand edit or... ?

Sorry for the lack of understanding.

Just seen this.

If you have been infected with the "base64_decode" problem and have shell access to the server, I have a bash script here that will clean it up for you.

 

[Pho]

To add to the above I also found this cleaner from Succuri Security which will fix it from a PHP script (handy if you don't have SSH access). I had to manually clean this once (fortunately I had SSH), wish I'd found these scripts sooner however as I had to write my own .

Note: It won't work if the regex isn't right. One site I fixed I had to modify the regex to get it to work as the malware had changed its signature. Once I fixed that it chomped through hundreds of PHP files in a matter of seconds.