I'm not sure how this happened, but my server techs notified me about some php files inside the includes folder sending out 50k worth of emails. I'm not sure how anyone would be able to upload that. I doubt its because my username/password was compromised for the domain. im finding these files littered through out the directories: http://prntscr.com/rhf93

In those files they contain all similar encoded php code:



Does anyone know what its doing or how i can decipher the code? And most of all how was it uploaded?

  • 1
    It could be a million things. Do a search here, as there have been some recent questions about this.
    – mpdonadio
    Commented Feb 4, 2013 at 0:03
  • Directory structure shows its a Wordpress a installation. Isn't it ? Wordpress has many security issues and is easy hackable is we dont care our site on a day-to-day basis. bit.ly/WkzWwY & bit.ly/14Lj6fE
    – niksmac
    Commented Feb 4, 2013 at 7:20

1 Answer 1


Notice how most of these code snippets begin with "preg_replace('/(.*)/e'"? That's because it's an alternative to the eval() function for executing PHP. The rest of the string is hexadecimally encoded; you can decode it using this script. That string will decode to PHP that probably executes other scripts or performs other actions to hijack your site and make it part of a spam mailing net.

Check out this StackExchange post for more details and suggestions. There are a bunch of good articles out there too that can give you tips on securing your server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.