Hello,
these days we see new type of php-malware. Malware occurs in many
different files, but all expand to same php-malware.
for examle here i have 4 files i have found:
http://pastebin.com/TzudTPPt
All files expand to something like this and are used to send spam:
http://pastebin.com/jhVRMwpE
I dont find big similarities to create one powerful signature. Need help
to create one signature. Otherwise i had to create one signature for
each file.
Please give me a hint in this case.
Thanks,
Hajo
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
