我的服务器上有病毒文件systems.php？

Question

I found a file systems.php on my webserver that neither I - as user - placed there, nor my webserver provider has placed in there. I viewed the file, it only contains one preg_replace() statement with an extremly long $replacement part, which seems to be somehow encoded.

preg_replace("/.*/e","\x28\x65\...\x29\x29\x3B",".");

If I interpret this statement correctly, it would mean that basically everything shall be replaced be the $replacement part (which might be encrypted/encoded virus injection stuff).

I have uploaded the whole code as pastebin here . Someone has an idea in what way the code is encrypted/how it can be decrypted in order to assess the grade of compromisation of my server?

Update

This might be the attack vector:

So after some digging, we found that this script was planted using a vulnerability in the Uploadify jQuery library. The library's existence was discovered by the attacker through google. ^source

Answer 1

It's look like a Shellcode, which can be disastrous for your server, shellcode executed by the CPU can give access to a shell or shuch of things. For more informations about shellcodes here's a good article :

http://www.vividmachines.com/shellcode/shellcode.html

This upload may hide a possible exploit on your server which grant access to upload or write data into, try to check your logs to identify the problem.

Answer 2

Unhexxing the shellcode shows it's executing eval(gzinflate(base64_decode(huge string));

I changed this eval to an echo and the full output is on pastebin here:

http://pastebin.com/t1iZ5LQ8

I haven't looked much further into this but it certainly seems dodgy. Just thought I'd do some of the legwork for anyone interested in looking at it further

EDIT

Little bit more detailed look, it appears to allow an attacker to upload files to your server, and take a dump of any databases on the box