The eval(base64_decode()) has infected a server. This is a PHP virus that uses the eval function in PHP and replicates itself to all the PHP files on the system as far as I'm certain. Would removing executable permissions help solve the problem?!


Please answer really fast, and also, if you've got any better ideas on how to stop this virus.. I'm all ears. The virus has replicated itself to several folders in the directory and most of the other folders are actually several other websites...

  • eval(base64_decode()) is not a virus. It is a command to <b>eval</b>uate (aka run) something. The software should take great care in what it allows to run. Running something which the user inputted on the webserver should not be allowed, regarless if it is base64 encode or not. – Hennes Jun 3 '14 at 16:48
  • The fix is not to remove the eval function (or to change permissions). The fix is not to run code which does insane unsafe things. – Hennes Jun 3 '14 at 16:49
  • What would be the most appropriate permissions for PHP to run properly without the use of the eval function? Btw, the 'eval(base64...' virus is known to replicate itself to PHP pages. It adds a bit of code in the first part of the files. – Ihsan Jun 4 '14 at 1:35
  • @Hennes sorry I typed the question in a hurry. The virus uses the eval function in PHP, it's a known virus that comes in this form on PHP webservers. I edited the question just now. – Ihsan Jun 4 '14 at 1:41

No, for a typical installation removing the execute bit will not solve the issue and it will not prevent further spread of the virus. PHP is typically interpreted by the webserver, and not directly executed by the OS, so the execute bit has no effect.

You should take the server offline immediately, clean up the infection, and patch the hole being exploited before taking it back online.

  • If the webserver ran under its own account (as it should be): Yes, that would work. If it had too many rights, then reinstall from scratch. Also see this post – Hennes Jun 3 '14 at 16:51
  • @Hennes: That post is for a typical PC virus, but this is a PHP worm which operates differently. The execute permission typically has no effect on PHP files operating under a webserver context. If you removed the read permission it would probably help, but you might as well take the server offline instead. – Icydog Jun 3 '14 at 16:53
  • @Icydog - PHP/Apache/IIS can only create and modify files the OS allows it to modify. I agree with the last sentence, there is an infection, and its not a PHP eval command. – Ramhound Jun 3 '14 at 17:32
  • I'm using GoDaddy's interface and the image above is the only way I can assign permissions to a folder. Also, I don't have an option to take it offline and clean it up. – Ihsan Jun 4 '14 at 1:37
  • @Icydog: I agree it should be different. But some people run the webserver with elevated permissions or under a normal account (of G-d forbid as root). @ Bravo: Do you have regular ssh access to the account? – Hennes Jun 4 '14 at 5:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.