I unfortunately found today that I have a malicious script on my website. It is chmodded 644, but I cannot delete it. Directories above it would permit me to delete it normally. The interface is cPanel.
I found out the name of the creator from the bottom of the source code behind it.
This script is very nasty, and is in every directory of my website. Fortunately, I have a clean backup and I plan on restoring that ASAP.
From the source, I have derived that it is used to "crack" ftp passwords, mysql databases, security in general, and it can (unfortunately) do a lot more than that too, including have direct access to every single file on my account. It targets certain scripts, namely phpbb, smf, and vbulliten, but I have none of these running on my website.
Is there a script to force-remove this virus/worm/whatever the heck it is without triggering it?
It appeared in all directories where the chmod was at least 755 for a fact, and a few where it was 644 somehow.
What do I do? Nobody has run it yet, it is simply sitting there in place. No access logs have any record of anybody doing anything with it (yet)
Whats the best path for me to take? I have been hearing that it is on the whole server, not just my account.
Also, sorry if this site is not the right place to ask it, I figured this was the best though because it directly relates. Any way to just blacklist the file name?