Short intro to the story:
故事简介:
On of my VPS servers got hacked. While trying to asses the damage, I have noticed most of the 'owned' php files have encrypted code (via base64 and eval) - no pattern to match them all. But I have also noticed in the folders via ftp there's a '..' file showing up, which everywhere it shows has the same first line of text: 'vFPuWN80hSq17G4OF8oyhg==' .On of my VP
