-1

I have a windows server 2008 with PHP on it and a few Wordpress sites on it. I got a virus some time ago. I thought I had it deleted and everything was fine but after looking at my Quarantine section of my antivirus, I noticed that everyday it catches this virus.

Here is a description from the Antivirus (Microsoft Security Essentials).

Category: Backdoor

Description: This program provides remote access to the computer it is installed on.

Recommended action: Remove this software immediately.

Items: file:C:\Windows\Temp\phpE138.tmp

Get more information about this item online.

I don't have a clue where the source of this virus is at. Some people say it could be hidden behind an image (using base 64 decode they get the actual code and run it), others say it gets stored in the database... thing is that everyday my antivirus catches this, what it seems to be" self generated files in the temp folder.

Has anyone experienced this before?

Thanks.

0

1 Answer 1

3

<blink>Destroy the server and recover from known good backups.</blink>

enter image description here

Not the answer you're looking for? Browse other questions tagged .