The latest virus PHP.Alf that infects PHP and web files_PHP Tutorial

News from ESET, a new virus and its variants that specifically infect PHP and Html files have been discovered recently. I hope all PHPers will pay attention to it and upgrade your anti-virus software in time.

Name: PHP.Alf

Virus type: worm

Infection length: 846 bytes

Hazard level: Medium

Propagation speed: Medium

Technical features:

This is a very simple virus that specifically infects files with the suffix .php, .htm and html. After the virus runs, it first renames itself Script.php. To complete this function, it proceeds through the following steps:

1. Rename yourself Dir.php;

2. Create C:Php (if this directory does not exist on the local machine);

3. Move yourself to the C:Php directory and still name it Dir.php;

4. Move back to the directory where you just started running, and change the file name to Script.php.

Then, the virus searches for files containing the following suffixes in its running directory:

1..php

2. .htm

3..html

It will open every file found and look for the string "Alf.php" in it. If this string is not found, the file will be infected. However, it simply adds a reference mark to the end of the file so that the virus runs every time the infected file is opened.

It appears that the virus searches for the "Alf.php" text string which is used as an infection marker so that a file will only be infected once. However, since the infection process only adds a reference mark to the end of the file and does not actually copy the virus code into the file, the file can still be infected multiple times.

http://www.bkjia.com/PHPjc/629767.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/629767.htmlTechArticleNews from ESET, a new virus and its variants that specifically infect PHP and Html files have been discovered recently. Hope Dear PHPers, please pay attention and upgrade your anti-virus software promptly. Name: PHP.Alf...