Malware Signatures

  2. Home
  4. Malware Signatures
  6. php.backdoor.eval_request.004

php.backdoor.eval_request.004

This is generic signature. Backdoor are often reading the payload code from the $_REQUEST variable. This way, an attacker is able to fill it with whatever code he wants and running this code without changing the actual backdoor file.

Affecting

Any PHP based web site (often through outdated WordPress, Joomla, osCommerce, Magento, Drupal and stolen passwords).

Cleanup

Cleanup is done by deleting the malicious file, which can be found in your system by searching for the dump code below inside your files. Reviewing access logs for non-expected HTTP POSTs can point out the possible infected files.
You can also sign up with us and let our team remove the malware for you.

Dump

eval (base64_decode ("aWYgKGlzc2V0KCRfUkVRVUVTVFsnYXNrODUnXSk