病毒文件系统.php在我的服务器上？

Question

I found a file systems.php on my webserver that neither I - as user - placed there, nor my webserver provider has placed in there. I viewed the file, it only contains one preg_replace() statement with an extremly long $replacement part, which seems to be somehow encoded.

preg_replace("/.*/e","\x28\x65\...\x29\x29\x3B",".");

If I interpret this statement correctly, it would mean that basically everything shall be replaced be the $replacement part (which might be encrypted/encoded virus injection stuff).

I have uploaded the whole code as pastebin here. Someone has an idea in what way the code is encrypted/how it can be decrypted in order to assess the grade of compromisation of my server?

Update

This might be the attack vector:

So after some digging, we found that this script was planted using a vulnerability in the Uploadify jQuery library. The library's existence was discovered by the attacker through google. ^source

Answer 1

Unhexxing the shellcode shows it's executing eval(gzinflate(base64_decode(huge string));

I changed this eval to an echo and the full output is on pastebin here:

http://pastebin.com/t1iZ5LQ8

I haven't looked much further into this but it certainly seems dodgy. Just thought I'd do some of the legwork for anyone interested in looking at it further

EDIT

Little bit more detailed look, it appears to allow an attacker to upload files to your server, and take a dump of any databases on the box