feebs
I don't think we have the virus, but it is on our server and it is try to infect other computers.
it renames the index.php file in all folders to _index.php then created its own index.php which try's to install an extension or gets the user to download help.zip
it also creates a.php, a.asp, and a.pl in each folder that has an index page.
we deleted it yesterday, but it came back this morning.
I ran a clamav scan in the web folder and found 84 infected files.
if this is not a virus, what is it? are we just serving these files to other computers?